When a contact opens an expired Client Portal magic link, they are automatically redirected to the one-time passcode (OTP) login flow instead of seeing an error.

What changed

• Automatic fallback for expired magic links: expired links now route to OTP verification.
• OTP verification with masked email: an OTP is sent to the contact’s email address, and the email is masked on-screen for privacy.
• Easier account recovery: contacts can regain access without requesting or generating a new magic link.

How it works

1. A contact clicks an expired Client Portal magic link.
2. They are redirected to the OTP verification screen.
3. An OTP is sent to their email address.
4. The contact enters the OTP to sign in and access their account.

No setup is required. This fallback is enabled automatically for Client Portal magic link authentication.

Notes

• Applies to Client Portal magic links using auth-v2.
• Expired magic links fall back to OTP-based authentication.
• Contact email addresses are masked on the OTP verification screen.