Requires: Charitable Pro 1.8.16+ Charitable Ambassadors 3.5.0+
Passwordless fundraiser accounts work by emailing a one-time sign-in link. Those links have to live somewhere until they are used, and this page explains exactly where, for how long, and how to remove them.
If you are only turning the feature on, you do not need to read this. It is here for people who want to know what a plugin is putting in their database, and for anyone handling a data request or an uninstall.
The short version
- One extra database table, created the first time you switch passwordless on.
- It holds hashes of sign-in links, never the links themselves.
- Rows are short lived: a signup link lasts 24 hours, a sign-in link one hour.
- Turning the feature off leaves the table alone. Nothing is deleted behind your back.
- Uninstalling the plugin also leaves it alone, deliberately, so an accidental deactivation never destroys data.
When the table is created
The table is created the first time Passwordless Accounts is enabled on Charitable > Ambassadors > Templates > Submit Form. It is not created on plugin activation, and it is not created on sites that never use the feature.
Its name follows your database prefix:
wp_charitable_ambassadors_signin_tokens
If your prefix is not wp_, substitute yours.
What is inside the table
One row per sign-in link issued. The columns:
| Column | What it holds |
|---|---|
id |
Row identifier |
token_hash |
An HMAC-SHA256 hash of the link, keyed on your site’s salts |
purpose |
signup for a new account, signin for a returning fundraiser |
email |
The address the link was sent to |
user_id |
The account, for a returning fundraiser. 0 for a new signup, because no account exists yet |
campaign_id |
The fundraiser the link relates to |
created_at |
When it was issued |
expires_at |
When it stops working |
redeemed_at |
When it was used, or empty if it has not been |
The link itself is never stored. Only a keyed hash of it is, so somebody reading this table cannot reconstruct a working sign-in link from it. The hash is keyed on your site’s own salts, which means a copy of the table lifted onto a different site is inert.
The address is stored in plain text, because the feature has to be able to email the person and show you who is waiting.
How long rows last
| Link type | Lifetime |
|---|---|
| Signup (a brand new fundraiser) | 24 hours |
| Sign-in (a returning fundraiser) | 1 hour |
Links are single use. Redeeming one marks it used, and asking for a new link cancels any earlier one for the same address, so only one live link per person exists at a time.
The self-check states
The Submit Form screen reports on this table so you are not left guessing. The states you may see:
| State | Meaning | What to do |
|---|---|---|
| Enabled, table present | Normal. | Nothing. |
| Enabled, table missing | Signups and sign-ins both fail. | Turn the feature off and on again. That recreates the table. |
| Enabled, schema out of date | The table exists but predates an update. | A developer can bring it current, see the reference below. |
| Enabled, links outstanding | A count of links sent but not clicked. | Informational. Check Awaiting Sign-In if it looks high. |
| Enabled, sign-in email disabled | Returning fundraisers cannot request a link. | Re-enable that email under Charitable > Settings > Emails. |
| Disabled, table still present | Your existing data is preserved. | Nothing. This is reassurance, not a problem. |
Turning the feature off (soft disable)
Untick Passwordless Accounts and the feature stops: no new links are issued, and the create-fundraiser form asks for a password again.
The table and its rows are left in place. Anyone who already has a valid link can still use it, and accounts already created keep working exactly as normal accounts, because that is what they are. Switching the feature back on resumes where you left off.
Nothing is lost by toggling it, which is the point: a setting that quietly destroyed data when unticked would be a bad setting.
Permanently deleting the data
Two separate things can be removed, and they are removed in different ways.
Outstanding links. All unredeemed links can be invalidated at once from the settings screen. Anyone mid-flow will need a fresh one. This empties the live links without touching accounts.
The table itself. Uninstalling Charitable Ambassadors does not drop this table, on purpose. The same precedent applies as for invitation tokens: an uninstall is sometimes an accident, and a plugin that destroys a table on deactivation gives you no way back. If you genuinely want it gone, a developer can drop it, or your host can from phpMyAdmin.
Accounts are not in this table. Fundraiser accounts are normal WordPress users and live in your users table like any other. Deleting sign-in link data does not delete anybody’s account or their fundraiser page.
Exports, backups and personal data
- Backups include this table like any other. Since it holds only hashes and addresses, a backup carries no usable sign-in links.
- A WordPress personal-data export for a fundraiser returns their account and their campaigns in the normal way. Sign-in links are short-lived operational records rather than profile data.
- A personal-data erasure removes the account through WordPress’s own tooling. Any outstanding link for that address stops working, because it no longer resolves to anybody.
Tips
- If signups suddenly stop working across the whole site, check the table-missing warning first. It is the one failure that breaks everything at once and it has a one-click fix.
- A high outstanding count early in a campaign usually means a deliverability problem, not disinterest.
- Do not copy this table between sites. It is keyed to the salts of the site that created it and will not work elsewhere.
Developer reference
Schema class
Charitable_Ambassadors_Passwordless_Schema
| Member | Purpose |
|---|---|
table_name() |
Prefixed table name |
exists() |
Whether the table is present |
is_enabled() |
Whether the feature is on |
SCHEMA_VERSION |
Current schema version, 1.1 |
SCHEMA_VERSION_OPTION |
charitable_ambassadors_passwordless_schema_version |
Option keys
| Option | Purpose |
|---|---|
charitable_ambassadors_passwordless_schema_version |
The installed schema version |
charitable_ambassadors_passwordless_rewrite_version |
Tracks when the endpoint’s rewrite rules were last registered |
Both are removed by the plugin’s uninstall routine. The table is not.
Tokens class
Charitable_Ambassadors_Passwordless_Tokens
| Method | Purpose |
|---|---|
issue( $purpose, $email, $user_id, $campaign_id ) |
Mint a link |
lookup( $token ) |
Read a row without consuming it |
redeem( $token ) |
Consume a link, atomically |
invalidate_for_email( $email ) |
Cancel every link for one address |
invalidate_for_user( $user_id ) |
Cancel every link for one account |
purge_all() |
Cancel everything outstanding |
effective_ttl( $purpose ) |
Lifetime in seconds for that purpose |
Filters
| Filter | Purpose |
|---|---|
charitable_ambassadors_passwordless_storage_docs_url |
The URL this page lives at, as linked from the settings help text and the self-check notices |
charitable_ambassadors_awaiting_mask_email |
Return false to show full addresses in the Awaiting Sign-In view |
