TivroMagicLink for WHMCS

TivroMagicLink adds secure, one-click passwordless sign-in to your WHMCS client area, allowing clients to log in using a secure link sent directly to the email address they already control — without typing or remembering a password.

Because there is no password to phish, guess, or leak, passwordless authentication can reduce exposure to credential-based attacks. Every magic link is single-use, rate-limited, and automatically expires. The new sign-in option works alongside your existing client area login page, while branding, security, and link activity are managed from the dedicated admin panel.

Passwordless Sign-in

• One-Click Sign-In Via Email — Clients receive a secure sign-in link directly in their inbox and can access their account with a single click.
• "Email Me a Sign-In Link" Option — Add a passwordless sign-in option directly alongside the password field on your existing WHMCS client area login page.
• Passwordless-Only Mode — Optionally hide the traditional password form and make magic links the only available sign-in method.
• Configurable Landing Destination — Choose where clients are redirected after successfully signing in.
• Custom Button Label & Icon — Configure the sign-in button wording and icon to match your brand.

Security & Anti-Abuse

• Single-Use, Auto-Expiring Links — Every magic link can only be used once and automatically expires, preventing reuse.
• Rate Limiting & Resend Cooldown — Configure request limits per email address and IP address, along with a cooldown between resend requests.
• Same-Device Binding — Optionally restrict a magic link so it can only be used in the browser that originally requested it.
• IP Restrictions — Optionally require an exact IP match, the same network, or the same country before a link is accepted.
• Turnstile / reCAPTCHA Challenge — Add Cloudflare Turnstile or Google reCAPTCHA protection to the sign-in link request form.
• Enumeration-Safe By Design — The request form does not reveal whether a submitted email address belongs to an existing account.
• Owner-Only Delivery — Magic links are sent only to the account holder's email address stored in WHMCS.
• Sign-In Alert Emails — Optionally notify clients when their account is accessed, including the time, IP address, and approximate location.
• Automatic Link Invalidation — Requesting a new magic link immediately invalidates any previously issued outstanding link.

Appearance & Branding

• 7 Sign-In Page Designs — Choose from Card, Minimal, Accent Bar, Dark, Gradient, Glass, or Split Hero layouts.
• Brand Accent Colour — Apply your selected accent colour consistently across pages, buttons, and links.
• 10 Button Styles + Custom Builder — Choose from ready-made button styles or create your own design with a live preview.
• Fully Self-Styled Pages — Sign-in pages render consistently across different WHMCS themes without depending on the theme's styling.
• Responsive By Default — Designed for a responsive and mobile-friendly experience across devices.

Admin Tools

• At-A-Glance Dashboard — View sent, used, and active magic link counts alongside recent activity.
• Send Links From Client Profiles — Trigger a passwordless sign-in link for any client directly from their WHMCS admin profile.
• One-Click Revocation — Instantly revoke any outstanding magic link.
• Client Group Restrictions — Restrict passwordless authentication to selected WHMCS client groups.

Localization & Delivery

• Fully Translatable — Localise all client-facing strings for your audience.
• Native WHMCS Email Delivery — Magic links are delivered through your existing WHMCS mail configuration and use editable WHMCS email templates.

Compatibility

• WHMCS: 8.x+
• PHP: 8.1+
• License: Valid license required