The Email Login addon for WHMCS lets clients access and pay invoices through secure, time-limited links delivered by email. Clients can proceed to payment without entering their login details, while configurable expiry and usage limits control link availability. Generated links can also be embedded in customised PDF invoice templates.

Features

• Access: Generates secure login links using 32 random bytes with HMAC-SHA256.
• Expiry: Sets link lifetimes from 1 to 365 days (default 30).
• Usage: Enforces usage limits per link (default 5, 0 for unlimited).
• Invoices: Verifies ownership and auto-expires links when invoices are paid or cancelled.
• Email: Provides plain URL and HTML merge fields for email templates.
• PDF: Integrates custom payment buttons into PDF invoices.
• Navigation: Restricts access to client area pages based on link settings.
• Administration: Manages, filters, copies, and manually expires links while preserving logs.
• Logging: Tracks SSO logins, admin overrides, and error events.
• Cleanup: Auto-purges links expired over 30 days ago.

Security

High-level cryptographic standards are enforced across all generated authentication tokens and client sessions.

1. HMAC-SHA256 key generation with secret key
2. Cryptographically secure random number generation
3. Invoice ownership verification
4. Session-based access control
5. Activity logging for audit trails