One-time email code
Passwordless login for BigCommerce, with a one-time email code
A shopper types their email address, gets a six-digit code, and types it back on the same page. There is no password to remember and nothing to click in the email. It sits beside your password form, and it is not the same thing as BigCommerce’s emailed sign-in link.
1/7 On the sign-in page, a shopper with no social account picks the emailed code.
How it works
How does passwordless login with a one-time email code work?
Three steps, in place on the page, in your theme’s own styling.
The code flow runs in a card on the page the shopper is already on. It borrows its fields, button and error styling from your theme, so it looks like part of your store, and the shopper never leaves the page. It is one of the app’s sign-in methods (Google, Facebook, X and email code), and the one that needs no social account.
Step 1
Send the code
The card opens with “Sign in with a code” (“Sign up with a code” on the create-account page) and one field for the email address. Before anything is sent, the app checks the address; the next section says what that check does on each page.
Step 2
Check your inbox
One full-width field takes the six digits and submits when the sixth lands, paste included. “Didn’t get it? Resend in 30s” counts down to “Send a new code”, and “Change” goes back to fix a typo. The button reads Sign in, or Continue for a new address.
Step 3
Almost done
Only a shopper the store has never seen gets this step: first and last name, side by side, then Create account. A returning shopper is signed in at step two.
What happens when the code is right
A code proves the address the same way Google’s verified email does, so the same account rules apply. When exactly one customer in the store has that address, the shopper is signed in as that customer. When none has it, the shopper is new: the app asks for a first and last name, or hands over to your store’s own registration form when it needs more than a name, and then creates the account. When several customers share the address, the app does not guess. The shopper is told that more than one account uses the email and to sign in with their password instead.
What a code does not do
A code does not retire a password, and it does not leave a standing link between the shopper and the app, as connecting Google does. It proves the address afresh each time, so there is nothing to connect or disconnect, and the method is not shown in account settings. Past guest orders are attached when your store allows it.
Where it appears
How does the email code behave on the sign-in, create-account and checkout pages?
The same three steps everywhere. What changes is whether the app will send a code to an address it has never seen.
Before a code goes out, the app checks the address with the same lookup the sign-in page uses to recognise a returning shopper. The answer decides what the page does.
| Page | How it is offered | If the address has no account |
|---|---|---|
| Sign-in page | How it is offered“Sign in with a code”, beside Google, with “We’ll email you a one-time code” under it. Your store’s own form sits last, behind an “or”. | If the address has no accountAn inline error under the field, “The account with this email doesn’t exist. Try a different email.”, and nothing is sent. |
| Create-account page | How it is offered“Sign up with a code”. A notice for an address that already has a password account offers the code button too, and it sends straight away. | If the address has no accountThe code goes to any address, because this is a sign-up. An address that already has an account is told the code will sign it in. |
| Checkout | How it is offeredOn the customer step of the Optimized One-Page Checkout: on the guest step, and on the known-address step for password accounts, where the code goes straight out to the address the store already has. “Continue as guest” stays where the checkout offers it. | If the address has no accountThe same inline error as on the sign-in page, and nothing is sent. |
| Header menu | How it is offeredIn the header, the code is offered in the account dropdown or in the small sign-in window the header’s links open, and it opens the sign-in page on the code step. | If the address has no accountAs on the sign-in page. |
| Account settings | How it is offeredNot shown. A code proves the address each time, so there is nothing to connect. | If the address has no accountNot applicable. |
That check keeps the sign-in page honest. Signing in needs an account to sign in to, and a typo is caught on the spot instead of quietly becoming a new account. The create-account page has no such rule, since a sign-up is meant to make one.
The words are yours. On the Email code page of the dashboard a merchant can reword the button (up to 40 characters) and the line under it (up to 80), and set the button’s colours. The wording is used on every page. Left alone, the button reads “Sign in with a code”, with “We’ll email you a one-time code” under it, in dark with white text.
Code or link
BigCommerce passwordless login: how is a one-time email code (OTP) different from a magic link?
BigCommerce’s own passwordless login emails a one-time link. This app emails a one-time code. Side by side:
BigCommerce has its own passwordless login, and it is a link, not a code. Its developer documentation, Passwordless Customer Login, opens in a new tab, describes a request an application sends to the store; BigCommerce then emails the customer a one-time link that signs them in to their storefront account. Store Social Login’s email code is a different mechanism with a different trade-off, and the two can sit side by side on one store.
| Compared on | BigCommerce’s passwordless login: a link | Store Social Login: a code |
|---|---|---|
| How it is offered | BigCommerce’s passwordless login: a linkDocumented as a request an application sends to the store: a POST to /login.php?action=passwordless_login with the customer’s email address and an optional redirect_url. | Store Social Login: a codeA switch in the app’s dashboard. The shopper types their address into a card on your storefront page. |
| What the shopper receives | BigCommerce’s passwordless login: a linkAn email with a one-time link. Clicking it signs them in to their storefront account. | Store Social Login: a codeAn email with a six-digit code, which they type back on the page that asked for it. |
| After sign-in | BigCommerce’s passwordless login: a linkThe optional redirect_url must be on the same domain as the store. Without it, a successful sign-in goes to the account page and a failed one to the sign-in page. | Store Social Login: a codeBack to the storefront page the shopper started from (a path on the same origin); sign-in pages lead to the account page. |
| How long it works | BigCommerce’s passwordless login: a linkThe response carries an expiry, in seconds. The documentation’s example is 900, which is 15 minutes. | Store Social Login: a code10 minutes. A newer code for the same address replaces the older one. |
| Use and tries | BigCommerce’s passwordless login: a linkA one-time link. | Store Social Login: a codeSingle use. Five wrong entries invalidate the code. |
| Tied to a page | BigCommerce’s passwordless login: a linkThe documentation page does not say. | Store Social Login: a codeYes. The code is only good on the page that asked for it. |
| An address with no account | BigCommerce’s passwordless login: a linkThe request returns a 404: the email does not belong to a customer. | Store Social Login: a codeSign-in page and checkout: an inline error, and nothing is sent. Create-account page: the code goes to any address, because it is a sign-up. |
| Limits on requests | BigCommerce’s passwordless login: a linkA request that is rate limited returns a 429. | Store Social Login: a codeOne code per address every 30 seconds, limits per address, per visitor and per store, and a limit on verification tries. |
| The email | BigCommerce’s passwordless login: a linkUses the store’s existing email templates. The subject is “{Store name} - Log in to your account”. | Store Social Login: a codeThe words, sender display name, reply address, colour and logo are the merchant’s. It is sent from sign-in@mail.storesociallogin.com. |
The left-hand column is read from BigCommerce’s documentation page, opens in a new tab as it stood on 8 October 2026, and BigCommerce may change it. The right-hand column is what the app does today.
Neither is better for every store. A link is one click from the inbox, with nothing to type. A code can be typed straight into the page that asked for it, so the shopper stays where they were, and it is only good on the page that requested it. The app also offers BigCommerce’s own sign-in link where a shopper may want it: on the create-account page a notice for an address with a password account offers “Email me a sign-in link”, and at checkout an address connected to Google gets “Send me a sign-in link” in a line under the buttons. If the store has that link switched off, the shopper is pointed to the password instead.
The email
What does the sign-in code email look like, and what can a merchant change?
One fixed layout, in your store’s words.
The code arrives as an email from your store’s name, sent through the app. The display name is the merchant’s; the sending address, sign-in@mail.storesociallogin.com, is the app’s and does not change.
- From
- Harbor & Pine <sign-in@mail.storesociallogin.com>
- Subject
- 482913 is your Harbor & Pine sign-in code
Your Harbor & Pine sign-in code:
482913
It works for 10 minutes and only on the page that asked for it.
If you did not ask for a code, you can ignore this email. Nothing happens without it.
The merchant sets
- Subject, greeting, closing line and footer
- Sender display name
- Reply address
- Accent colour
- An optional logo
Stays fixed
- The sending address, sign-in@mail.storesociallogin.com
- The layout of the email
The default wording
Out of the box the subject reads “{code} is your {store} sign-in code” and the greeting “Your {store} sign-in code:”, followed by the code, a closing line (“It works for {minutes} minutes and only on the page that asked for it.”) and a footer (“If you did not ask for a code, you can ignore this email. Nothing happens without it.”). {store}, {code} and {minutes} are placeholders the app fills in, and they work in any text field.
Where the merchant changes it
The words, sender display name, reply address, colour and logo are set on the Email code page of the dashboard, in the card called “The code email”. The reply address starts as your store’s order email from BigCommerce’s store information. The dashboard shows the same preview the server sends, and “Send me a test” sends the saved wording with the code 123456, once a minute per address. “Back to standard” clears every edit.
The layout itself cannot be edited. A code email that keeps one recognisable shape is harder to break and harder to imitate.
Limits
How is a one-time email code kept safe?
A short life, one use, one page, and rate limits at every level.
Ten minutes, once
A code works for ten minutes and once. A newer code for the same address replaces the older one.
Five wrong tries
Five wrong entries invalidate the code. The shopper is told how many tries are left, and can ask for a new code.
Tied to the page that asked
The storefront script makes a random token for each sign-in and sends it with every step. The app keeps only a hash of it and refuses the code from anywhere else.
Checked against a keyed hash
Six digits are made on the app’s server with a cryptographic random generator. The records used to check a code hold only a keyed hash of it, so a copy of those records cannot be brute-forced offline. The code itself is in the email that carries it.
Throttled at every level
One code per address every 30 seconds. At most three codes per address and six per visitor in fifteen minutes, ten verification tries per visitor a minute, and a ceiling for the whole store.
The same reply either way
The server’s answer to a code request is the same whether or not the address has an account. The inline error on the sign-in page comes from a separate, throttled lookup. Whether an address has an account is already visible on a store’s create-account form and at checkout; the lookup adds only whether it is linked to a provider.
For the wider picture of what the app asks for, stores and never touches, see security and shopper data.
Questions about the email code
Does the email code replace passwords?
No, it sits beside them. The picker offers the code next to the other methods you have switched on and keeps your store’s own email and password form last, behind an “or”. Passwords and password recovery keep working, and signing in with a code does not retire or change anyone’s password.
What if the code email does not arrive?
The code screen shows “Didn’t get it? Resend in 30s”, counting down to “Send a new code”, and a newer code replaces the older one. If a code was requested a moment ago the shopper sees “A code is already on its way.” A wrong address can be fixed with the “Change” link beside it. If email cannot be delivered to the address, the shopper is told: “We can’t deliver email to this address. Check it, or use another way to sign in.”
Is the email code the same as an OTP or a magic link?
It is a one-time password sent by email: six digits the shopper types back on the page that asked for it, valid for 10 minutes. A magic link is a different thing: a URL in the email that signs the shopper in when it is opened. BigCommerce’s own passwordless login sends a link.
Is it the same as BigCommerce’s emailed sign-in link?
No. BigCommerce’s passwordless login emails a one-time link that signs the shopper in when it is clicked. This app emails a six-digit code that the shopper types back on the page that asked for it, and that works for 10 minutes. They can sit side by side on the same store.
Does the email code work at checkout?
Yes, on the customer step of BigCommerce’s Optimized One-Page Checkout. A shopper who types an address that has a password account is offered the code first, and it goes straight out to that address. “Continue as guest” stays available where your checkout offers it.
Can I change what the email says and who it comes from?
Yes: the subject, greeting, closing line and footer, the sender display name, the reply address, the accent colour and a logo. The sending address, sign-in@mail.storesociallogin.com, and the layout of the email stay fixed.
Keep reading
- Sign in with Google on your BigCommerce store
Shopper sign-in with Google, how existing customers are connected, and what happens to guest orders.
- Sign-in at BigCommerce checkout
How the code and Google work on the customer step while Continue as guest stays.
- What Store Social Login asks for, stores and never touches
The code limits in context, and what stays in BigCommerce.
- Add social login to BigCommerce: app or custom build
App or custom build: what the Customer Login API and Scripts API mean for the choice.
- Questions merchants ask about BigCommerce sign-in
Cost, setup, themes, duplicate accounts, guest orders and uninstalling.
- Social login for BigCommerce: the overview
Every place it works, and how it recognises returning customers.
Offer an email code on your BigCommerce store.
Store Social Login is in a private rollout, so access is by request. Tell us about your store and we will reply about getting sign-in onto your storefront.
Asking costs nothing and commits you to nothing. You will need your storefront address and, if you know it, your theme.