Magic-link email sessions need revocation evidence for edtech platforms

Moving email login off a managed provider shifts responsibility for revoking sessions onto the application itself, so single-use verification, refresh-token rotation, and a durable revocation decision should be defined before users migrate. A delivered login link alone does not show that verification succeeded or that a stolen session stopped working. For a learning platform, the test is whether a revoked learner's refresh tokens stop issuing credentials and whether protected requests respect the declared access-token revocation policy. The article argues that a healthy authentication dashboard is weak evidence, and that a useful audit record needs session identifiers, revocation and authorization timestamps, and the enforcing component. It also stresses that new email logins must not revive a revoked session and that email challenges need binding, expiry, and attempt limits.