External surfaces
One token link per audience — the ONLY external auth. Subs, customers, and applicants never see a login screen; the link IS the session. Partners are the one exception (OAuth invite).
SubConfirm work ordertoken …7c41dSubDay-of flow (check-in → photos → done)token …8f3a2CustomerSign your contracttoken …b90e4CustomerPay your deposittoken …d215fCustomerPick your colorstoken …4aa87PartnerPartner view (OAuth invite — not a token)v1.5OAuthApplicantInstaller application (public URL — no token)v1.5 · proposedOAuth
Expired/invalid token → friendly re-request screen
Tokens are single-audience, scoped, and revocable. Expiry never dead-ends the person — it always offers a re-request path.