Auto-Login Links

What auto-login links do

Auto-login links let you send a WordPress user directly into your site without asking them to enter their WordPress password. Syncly generates a short-lived, single-use URL that authenticates the intended WordPress user when the link is opened.

This is especially useful with GoHighLevel (GHL) email campaigns and automations. For example, you can send a contact from GHL to a members-only page after the contact has already been identified in your workflow.

How to generate an auto-login link

1. In WordPress, go to Users > All Users.
2. Open the WordPress user who should be authenticated.
3. Find the GoHighLevel section in the user’s profile.
4. Click Generate Auto-Login Link.
5. Copy the complete generated URL.
6. Place the URL in your GHL email, workflow, campaign, or other trusted message where the intended user will receive it.

The link is generated for the specific WordPress user whose profile you are editing. Always verify that you have selected the correct user before generating or sending it.

What the generated link looks like

After clicking Generate Auto-Login Link, Syncly provides a URL that you can copy and use in your trusted communication. The URL contains a temporary authentication token associated with the selected WordPress user.

Never publish the real generated URL in documentation. Treat it as an authentication credential.

What happens when the user opens the link

When the recipient opens an unused and valid auto-login URL, Syncly validates the temporary token and identifies the WordPress user associated with it. If validation succeeds, WordPress authenticates that user and continues the request without requiring the normal username/password login form.

The token is then consumed, so the same URL cannot be used as a permanent login method.

Token lifetime and one-time use

Auto-login links are intentionally short-lived and single-use:

• Expiration: the link expires after 15 minutes.
• One-time use: once successfully used, the token cannot be used again.
• Random token: the generated token is a 64-character cryptographically random hexadecimal value.
• Hashed storage: Syncly stores a SHA-256 hash of the token in WordPress user meta rather than storing the raw token.
• Cleanup: expired tokens are cleaned up automatically.

This design limits the usefulness of a leaked or intercepted URL and prevents a generated link from becoming a permanent login credential.

If the link does not work

If an auto-login link fails, generate a new link first. The most common reason is that the original token has expired or has already been consumed.

• Link is older than 15 minutes: generate a new link.
• Link was already opened successfully: it cannot be reused; generate another link.
• Wrong WordPress user: return to Users > All Users, open the intended user, and generate a new link from that profile.
• Link was copied incorrectly: copy the complete generated URL again and avoid manually modifying it.
• Testing repeatedly: generate a fresh link for each test because successful tokens are single-use.

Security considerations

• Never publish auto-login URLs on public pages, documentation, source code, or public logs.
• Do not include auto-login URLs in analytics events or third-party tracking parameters.
• Do not send a link generated for one user to another user.
• Use HTTPS on the WordPress site so the URL is protected while it is being transmitted.
• If a link may have been exposed, do not continue using it; generate a fresh link instead.

Recommended workflow

For production use, treat auto-login links as short-lived access credentials rather than ordinary page URLs. Generate them as close as practical to when they will be sent, send them only to the intended user, and avoid storing or logging the complete URL outside the systems that need it.

Quick checklist

• Open the correct WordPress user.
• Generate the link from the GoHighLevel profile section.
• Use the complete generated URL.
• Send it only to the intended recipient.
• Remember that it expires after 15 minutes.
• Remember that it can only be used once.
• Generate a new link when testing or when a previous link has expired or been consumed.
• Redact authentication tokens before taking screenshots for documentation.