Send an invitation by email

People receive their personal key or their second factor through a one-time link. Instead of passing the link on yourself, you can have the administration app send it from your email program as an HTML email with the installation's logo. The link is valid for 72 hours, survives a restart of the service, and can be used exactly once.

• The person's email address: the Mail-Adresse (Email address) field in their form. The app suggests it as the recipient.
• Templates: the Mailvorlagen (Email templates) tab in the Anmelderichtlinie (Sign-in policy) area. There's a built-in template for each purpose (collect a key, set up the second factor, welcome), and you can add your own by loading an HTML file.
• Sending: through classic Outlook on your workstation. Without classic Outlook (for example, if you only have the new Outlook), the app opens the email as a draft in your default email program. The app deletes the draft (an .eml file in the temporary folder) when you sign out or close it, because it contains the link, so send it before then.
• Whoever holds the link can use it: the first person to open it and confirm gets the key or sets up the second factor, and the service doesn't check who that is. No key is waiting in the administration store, though. Only the request and a SHA-256 hash of the link are stored; the key or second factor is created only when the link is used. A copy of the store file therefore opens nothing, but an intercepted email does, for as long as the link is valid.

Send an invitation

1. Open Personen und Schlüssel (People and keys), select the person, and enter their Mail-Adresse in the form if it's missing.
2. Choose Schlüssel (Keys) > Schlüssel per Mail senden … (Send key by email …) or Zweiten Faktor per Mail senden … (Send second factor by email …). Both are also on the row's shortcut menu.
3. For a key, enter the label and purpose as usual (Arbeitsplatz (workstation) or Präsentation auf Abruf (on-demand presentation)). If there's more than one template for that purpose, pick one.
4. Outlook shows the finished email. Review it and send it. If Mail vor dem Senden zeigen (an/aus) (Show email before sending) under Weitere in the Anmelderichtlinie area is turned off, the email is sent right away.

Result: The person gets an email with the logo, their name, the link, and how long it's valid. When they open the link, they see a button; only after they select it does the key or QR code appear, and only once. The key then shows up on the person's Schlüssel (Keys) tab, and the pickup is recorded in the change log (“Einmal-Link von …”, one-time link from …).

Customize templates

1. Open Anmelderichtlinie, go to the Mailvorlagen tab, and select a template.

   

2. Choose Mailvorlage bearbeiten … (Edit mail template …). The dialog shows the name, purpose, subject, and the content as HTML; the placeholders and what they stand for are listed on the right. Double-click a placeholder to insert it at the cursor. Vorschau im Browser (Preview in browser) shows the email with sample values.
3. Choose Speichern (Save). The service checks the template. If the template doesn't pass, a message lists the reasons and the dialog stays open.

To create a new template, choose Neue Mailvorlage … (New email template …) on the Mailvorlagen (Email templates) tab: after you pick the purpose, it starts as a copy of the built-in template for that purpose. To work in an HTML editor, use Weitere (More) > Mailvorlagen > Mailvorlage als Datei speichern … (Save email template as file …) and Mailvorlage aus Datei laden … (Load email template from file …).

Allowed placeholders: {{Person}}, {{Link}}, {{GueltigBis}} (valid until), {{Dienst}} (service), {{Absender}} (sender), and {{Organisation}} (organization). {{GueltigBis}} is given in UTC, including the time zone, for example “17.10.2026, 14:30 Uhr UTC”, because the recipient may be in a different time zone than you. Templates for collecting a key or setting up a second factor must contain {{Link}}. To include the partner's logo, use <img src="cid:brand">; for the mark of The White Knight Labs, use <img src="cid:logo">. The built-in templates show the logo at the top and the mark at the bottom. If a template breaks these rules, the service rejects it and lists every reason.

Settings for this workstation (in the Anmelderichtlinie area, under Weitere):

• Two kinds of one-time links:

  	Handover link (Schlüssel ausstellen …)	Email link (this page)
  Valid for	15 minutes by default (PickupMinutes in the service configuration)	72 hours by default (mail_link_hours)
  Service restart	invalidates it, because the waiting key exists only in memory	survives it, because no key is waiting
  Pickup	exactly once	exactly once; opening it again shows the date and time it was picked up

• How to send it: Until it's used, the link works for anyone who has it. So send it only to an address that only the person reads (no shared mailboxes, no forwarding), and keep the validity period no longer than the person needs to pick it up.
• Validity period: 72 hours by default. The Gültigkeit eines Einmal-Links (Validity of a one-time link) field (Einstellungen (Settings) tab, 1 to 720 hours) changes it for all new links.
• Already picked up: If someone opens a link a second time, the page shows the date and time it was picked up. If a person tells you they didn't open the link themselves, someone else has their key or second factor. Revoke the key or set up the second factor again right away, and check the change log for when and from where the link was used.
• Built-in templates can be replaced, but not renamed or deleted.
• Link previews: An email program that opens links to preview them doesn't pick anything up, because the page shows only the button at first.

• Create a person and issue a key
• Set up or reset the second factor
• Reference: HTTP: administration (reference), section “One-time links” (data service documentation)