E-commerce
July 1, 2026
"The login link no longer works." "I clicked but it redirects me to the home page." "Is it a code or a link? I don't understand anything." Three tickets where passwordless login (magic link or OTP) fails without a clear diagnosis.
The e-commerce magic link support covers expired link, invalid token, wrong device, email not received, and magic link vs 6-digit code confusion. Distinct from the general login guide (#294): here, the customer uses passwordless only, not legacy password reset.
This guide #837 deploys policy MAGICLINK-SUP, flow ML-1 to ML-8, and matrix MAGICLINK-MAP. Customer support pair of the future passwordless bot (#838).
Summary
Why do magic links generate support tickets?
Passwordless replaces the password with a unique link or email OTP. Each failure blocks access to orders, returns, and re-purchases. The agent suggests "reset password" even though the account is already passwordless Shopify new accounts.
Five typical magic link frictions
Expired link: TTL 15 min, customer clicks too late
Token already used: one click consumes the link
Missing email: spam, typo, deliverability
Wrong device: link opened on another browser
OTP confusion: expects a 6-digit code, receives a link
Shopify new customer accounts relies on passwordless login via email (Shopify, new customer accounts 2026).
DTC Example
Fashion store, 24 magiclink_ tickets/month. After MAGICLINK-MAP: magiclink_first_contact_resolution 89%, dev auth escalations -44%.
Convert over 2,000 customers on average per month with Qstomy.
The world’s 1st Shopify AI dedicated to customer conversion
Empowering 200+ e-commerce merchants
MAGICLINK #837 vs LOGIN #294, POSTACCT #821, ACCTEMAIL #825 and bot #838
Six pieces of content, six distinct client auth journeys.
Quick Matrix
#837 MAGICLINK: magic link, passwordless OTP, expired token
LOGIN #294: global legacy and history password login
POSTACCT #821: post-purchase account creation, link not expired
ACCTEMAIL #825: change login email distinct resend link
CONF-EMAIL #358: order confirmation distinct auth
Bot #838: guide passwordless tier 1
#837 = my magic link or login code is not working. #294 = I cannot log in (all methods).
Promise #837
MAGICLINK-SUP policy, MAGICLINK-GATE tree, 8 macros, passwordless matrix, magiclink_first_contact_resolution KPI.
Which magiclink_* typologies should be classified?
Action-oriented classifier: return link ≠ fix email typo ≠ explain OTP vs magic link.
Eight MAGICLINK-MAP typologies
magiclink_not_received: missing login email
magiclink_expired: link clicked after TTL
magiclink_invalid_token: corrupted or modified URL
magiclink_used_once: second click on the same link
magiclink_wrong_device: opened on another browser or app
magiclink_spam_folder: email in spam
magiclink_otp_confusion: expecting code, gets link or vice versa
magiclink_no_account: email without customer profile
MAGICLINK-SUP Policy: agent rules and escalation
The MAGICLINK-SUP policy defines what the agent can do without exposing tokens or sensitive data.
Six MAGICLINK-SUP rules
Verify request email: ticket email = profile email before resending link
Resend link, do not share URL: trigger new admin magic link, never paste token ticket
Explain single-use: MAGICLINK-ONE-CLICK macro before resending
Guide spam: MAGICLINK-SPAM before escalating deliverability
Do not reset password: passwordless account, route to LOGIN294 if legacy only
Document action: email, resend date, typology in ticket
Auth mode matrix (agent)
Magic link: unique single-click URL, short TTL
6-digit OTP: code entered on Shopify new accounts login page
Legacy password: LOGIN294 handoff classic reset
Flow ML-1 to ML-8: standard resolution
Eight sequential steps, auth SLA P2 < 4 h.
Flow ML-1 to ML-8
ML-1 Triage: read request, tag magiclink_*, email client
ML-2 Lookup: Shopify profile exists, account type new vs legacy
ML-3 Educate: MAGICLINK-OTP-DIFF if otp_confusion
ML-4 Classify: magiclink_* via MAGICLINK-MAP
ML-5 Execute: resend link, spam guide, create account if no_account
ML-6 Confirm: macro MAGICLINK-DONE exact scope
ML-7 Test: ask to confirm login within 15 min
ML-8 Close: KPI magiclink_first_contact_resolution
Eight ready-to-paste MAGICLINK-* macros
Clear macros on single-use, TTL, and passwordless channel.
MAGICLINK-* Library
MAGICLINK-OTP-DIFF : "Passwordless login: click the link received by email, or enter the 6-digit code if displayed. No password required."
MAGICLINK-ONE-CLICK : "Each link works only once and expires in {{ttl}} minutes. Click from the same device where you are logging in."
MAGICLINK-RESEND : "New link sent to {{email}}. Check your main inbox and spam folder within 2 min."
MAGICLINK-SPAM : "Look for an email from {{shop_name}} in Spam or Promotions. Add us to your contacts and then try logging in again."
MAGICLINK-DEVICE : "Open the link in the same browser or app where you want to access your account."
MAGICLINK-NO-ACCOUNT : "No account found for {{email}}. Create one from the login page or verify the email used for purchase."
MAGICLINK-LEGACY-ROUTE : "Your account still uses a password. Use "Forgot password" on the login page."
MAGICLINK-DONE : "Recap: link resent to {{email}}. Log in within 15 min. Contact us if failures persist."
MAGICLINK-GATE tree and Shopify configuration
Decision tree before dev escalation or inappropriate password reset.
MAGICLINK-GATE
Link expired or used_once ? → ONE-CLICK then RESEND
Email missing ? → SPAM then RESEND before deliverability #358
OTP confusion ? → OTP-DIFF then RESEND
Legacy account ? → LEGACY-ROUTE to LOGIN294
Checklist ops auth
Activate new customer accounts Shopify. Link TTL documented for agents. Never paste magic link URL in public ticket. Tag magiclink_* for resend audit.
KPI, QA and handoff to bot #838
Measuring MAGICLINK detects unnecessary resends and token leaks.
Four MAGICLINK KPIs
magiclink_first_contact_resolution: connection OK on first contact / total
magiclink_resend_rate: % of tickets requiring the link to be resent
magiclink_token_exposure_incidents: URL pasted into ticket, target 0
magiclink_repeat_7d: reopening the same topic within 7 days
Bot Handoff #838
Export MAGICLINK-MAP to intents bot_magiclink_resend, bot_magiclink_guide. Guardrail MAGICLINK-NO-TOKEN-EXPOSE-BOT: never display the link URL in the chat.
Edge cases: SSO, Shop Pay, email typo
Three cases outside the standard flow.
Shop Pay vs. shop account
Shop Pay login is separate from the merchant account. Clarify which portal the customer is looking for. Handoff LOGIN294 login_shop_confusion if needed.
Typo in email at checkout
Magic link sent to the wrong address. Verify guest order, handoff ACCTEMAIL #825 if correction is possible.
B2B company with multiple logins
Professional contact is using a personal email. Look up the B2B order before NO-ACCOUNT.
Agent training: 20 minutes MAGICLINK
Module: passwordless first, never paste link, ONE-CLICK before RESEND.
Exercises
Ticket A: expired link → ONE-CLICK then RESEND
Ticket B: waiting for OTP code → OTP-DIFF then RESEND
Ticket C: legacy account → LEGACY-ROUTE not magic link
How Qstomy structures MAGICLINK in your stack
Qstomy route magiclink_*, detects new vs legacy accounts and blocks macros exposing the token.
Three building blocks
Routing: intent magic_link vs login_general vs email_missing
Guardrails: NO-TOKEN-EXPOSE before close
Bot #838: guides passwordless tier 1 without sensitive data
FAQ and MAGICLINK deployment checklist
FAQ
Can we resend the same link?
No. Single-use token. MAGICLINK-RESEND triggers a new link.
Difference with #294?
#294 = all login modes. #837 = magic link and passwordless only.
Can an agent paste the URL in a ticket?
No. Security risk. RESEND admin only. token_exposure_incidents target is 0.
7-Day Checklist
Day 1: MAGICLINK-SUP + MAGICLINK-MAP + auth modes matrix
Day 2: 8 helpdesk macros
Day 3: Shopify new customer accounts audit activated
Day 4: 20 min agent training
Day 5: magiclink_* tags + KPIs
Day 6: test link resending without exposing ticket URL
Day 7: bot briefing #838 NO-TOKEN-EXPOSE
Interlinking
Enzo
July 1, 2026
