> I think that a link to a page where you enter a one time code gets around a lot of these issues. I've done both in my SaaS product - link is GET with the OTP

> I think that a link to a page where you enter a one time code gets around a lot of these issues. I've done both in my SaaS product - link is GET with the OTP in the link, the target page checks if the link is in the URL, and if not, then the user can type it in. Only for signup, though. For sign-in, the default is to always have the user type it in.