Link or code expired
Why an emailed link or code stops working, how long each lives, and how to get a new one.
On this page
Symptom#
You use a link or a code from an email, or from an authenticator app, and the page says one of the following (English wording; pages and emails follow your language, see Languages):
- This link did not work. It may have expired or been used. Ask for a new one.
- This link is incomplete. Ask for a new one from the sign-in page.
- This link or code is not valid any more. Ask for a new message.
- That code is not right or has expired.
- That code has expired. Send a new one.
- This invitation is not valid or has expired., or on the invitation page This invitation has expired. Ask for a new one. or This invitation was already used.
- This link is not valid any more.
Likely causes#
Every link and code is short lived and works once.
| Item | How long it lasts | Other rules |
|---|---|---|
| Emailed sign-in link or code | 15 minutes by default. An organization can change it. | Single use. It completes only in the browser that asked for it. |
| Emailed second-step code (the extra step, or Email me a code instead for a lost passkey) | 15 minutes by default, 2 to 15 minutes. | Single use. Requesting it for a lost passkey is limited to two a day for an account. |
| Sign-in in progress | Short lived | Stopped after repeated failures. |
| Email verification link | 24 hours at most; the platform can set it shorter | An unverified address cannot be used to sign in. |
| Recovery link | 15 minutes at most; the platform can set it shorter | Single use, and bound to the browser that asked. |
| Invitation | 7 days | Single use. |
| Authenticator app code | 30 seconds, with one step of tolerance either side | A code is accepted once. |
| Passkey prompt | 5 minutes by default; an operator can shorten it, to no less than 30 seconds | Single use. |
Beyond time, these are the usual reasons:
- Already used. Opening the same link twice, or entering a code you already used, fails the second time. Opening the link in the email does not sign you in by itself: the page that opens asks you to select Continue, and only that finishes the sign-in. A mail scanner that opens the link therefore does not use it up.
- A newer message replaced it. Asking again gives you a new link and code. Use the latest message.
- Another browser. The link is tied to the browser that asked for it. Opening it on your phone when you asked on your laptop does not complete the sign-in. Open it where you started, or start again where you are.
- The wrong code. An eight digit code from an email is not the six digit code from an authenticator app. Check which one the page asks for.
- No message was sent. Only a limited number of messages go to one address in a short while, and the service has a daily allowance. The page now says so, with Why does this happen? and a Reference: code, instead of waiting silently. See Why a message may never be sent.
- The clock. For authenticator codes, a device clock that is off by more than about half a minute gives codes that never match. See Clock skew.
- The lost-passkey message. Its link is to account recovery and holds no secret. If you cannot use the code, start recovery instead; an account with a passkey waits at least 24 hours.
- The message never came. The page says a message is sent "if this address can sign in", so a message that does not arrive can mean a typing error, a spam folder, an address that cannot sign in, or a delivery problem on our side. We could not send email right now. Try again in a few minutes. is the delivery case.
What to check#
- Look at the time on the email and compare it with the table.
- Check you are in the browser that asked for the link.
- Look in spam and promotions folders, and check the address you typed.
- Make sure you are using the newest message.
Fix#
- Go back to the sign-in page, in the browser you want to sign in with, and select Email me a sign-in link again. Or, on Check your email, select Send again, which becomes available after a short wait.
- Open the link, or type the Code from the email, within the time. Select Continue, or Verify.
- If an authenticator code keeps failing, choose Use a recovery code instead where your organization allows it, and correct your device clock.
- For an invitation, ask the person who invited you to send a new one.
If requests are refused because you asked too many times, wait for the time the page gives (in seconds, minutes or hours) and try again. See 429 Too Many Requests.