How the email one-time-code method works and how to choose who can sign in.

How it works

Email sign-in is the zero-setup onramp. It needs no identity provider and no credentials. A visitor enters their email address, receives a single-use code, and types it back to prove they own the address. There is no password and no account to create.

A visitor is admitted only when their address matches your allowlist. Everyone else is turned away, so the site stays private.

Choose who can sign in

You control access with two allowlists, set when you pick Email one-time code in the New site wizard or later under Edit sign-in:

• Allowed email domains — anyone with an address at one of these domains can sign in (for example, example.com admits anyone@example.com).
• Allowed email addresses — individual guests outside those domains (for example, a partner at guest@partner.example).

A visitor is admitted when their address matches any allowed domain orany allowed address. Both lists are optional, but enter at least one, or no one can sign in.

When to use it

Email is the quickest way to gate a site and a good fit for small or mixed audiences. For a workforce that already has Google Workspace or Microsoft Entra ID, single sign-on is stronger: it adds your organization's multi-factor authentication and removes access the moment someone leaves. See Google Workspace sign-in and Microsoft Entra ID sign-in.