Your inbox is another way in

Sometimes the quickest route back to an app is already open in front of you: your inbox. M7 Identity now lets people sign in to a personal account through email, with one request and two ways to finish. Choose a magic link when email is handy, or enter a six-digit code when you would rather stay on the sign-in page.

One email, two ways to finish

Start from an app's usual M7 sign-in and choose Sign in with an email link or code. Enter the verified email address for your existing personal M7 account.

M7 sends a single email with both options. Say your inbox is on your phone while the sign-in page is on your laptop: read the six-digit code on the phone, then enter it on the original laptop page. Keep any leading zeroes. Prefer the magic link? It must return to the original browser and asks you to select Confirm email sign-in. The email sign-in guide walks through both paths.

Built for the browser in front of you

The two choices belong to one sign-in request. Opening a message preview alone does not complete the sign-in. Entering the code on the original M7 page is the other way to complete that same request.

There are a few practical details worth knowing. Links and codes last for ten minutes and can be used once; using either one uses up the shared request. Ask for a replacement and the earlier link and code stop working. A magic link opened in a different browser profile or private session cannot finish the request, so the code remains a convenient option when the inbox and sign-in page are not in the same browser.

Keep the sign-in flow familiar

Want an extra check after email sign-in? Turn on the separate Email sign-in setting in M7’s two-factor controls. M7 then asks for your current authenticator or recovery code after successful email proof. That extra check remains separate from proving access to email; the email sign-in policy explains how the setting works.

For developers, the hosted M7 authorization flow continues to do the work. Your app keeps its normal OpenID Connect Authorization Code with PKCE integration, including its callback and token exchange. The emailed six-digit value is for the hosted sign-in page, not an OAuth authorization code. You gain another way for people to sign in while keeping one integration to maintain. See the Authorization Code + PKCE quickstart for the integration flow your app continues to use.