An Unsubscribe Link That Needs No Password
The unsubscribe link at the bottom of an automated email is a compliance obligation wearing the clothes of a convenience, and almost every way of making it more careful makes it worse. Here is what it does and why each step is missing on purpose.
A confirmation step on an unsubscribe link does not protect anybody. It converts a person who wanted to leave into a person who reports you as spam.
Automated email sequences — onboarding, re-engagement, the ones that go out on a schedule rather than because somebody clicked send — carry three public endpoints with them: an unsubscribe, an open marker and a click redirect. All three are login-free by necessity, and all three are signed.
One click is the whole contract
Following the unsubscribe link opts the recipient out immediately, on the click itself, rather than presenting a page asking them to confirm. That is a deliberate choice and it is the right one for two independent reasons.
-
Mailbox providers treat one click as the whole contract
Modern mail clients present their own unsubscribe control and expect a single action to be sufficient. A sender who requires a second step is a sender whose unsubscribe is treated as unreliable.
-
A second step is where people give up
Somebody who has decided to stop receiving your email and meets a form has one faster option available, and it is the spam button. That costs you far more than the subscription would have.
-
The way back is on the confirmation page
Having opted out, the recipient sees a page telling them so and offering to resubscribe. The reversible direction is the one that gets the extra click, which is the correct way round.
The provider posts it themselves
There is a second unsubscribe endpoint that the mailbox provider calls directly, without the recipient ever visiting a page — the standard mechanism behind the unsubscribe button in a mail client. Because that request comes from the provider rather than from a browser session, it is exempt from the cross-site protections that guard ordinary form submissions. That exemption is deliberate, narrow and worth knowing about: it is the one route where a request with no session and no token is the correct thing to accept.
Signed, because the identifier is the address
Each link carries the identifier of a specific send. Without a signature, changing the number in the address would let anybody unsubscribe somebody else, or record activity against a message they never received.
The signature is what makes the identifier safe to expose. It proves the address was produced by the system rather than typed, and it is checked before the controller runs. That is the same mechanism used for supplier application tracking links and for the same reason: an outside party needs to reach one specific record, and the alternative is an account nobody wants.
A signature turns a guessable identifier into an unforgeable one.
The failure that would have been silent
This is the part worth reading if you build anything similar. These pages are reached from an email, so there is no signed-in user and nothing to establish which organisation the message belonged to. The send record is therefore looked up explicitly across organisations, with the signature standing as the authorisation.
Consider what happens if that is not done. When record lookups tightened so that a request with no identified organisation returns nothing rather than everything, an implicit lookup here would come back empty. The page would say it could not find the subscription. The recipient would remain subscribed.
And nothing anywhere would report a problem. The page renders, the link works, the emails keep arriving — and the only party who knows is the person clicking unsubscribe every week. That is not a cosmetic bug; it is a compliance failure that presents as a working feature, which is the worst combination available.
Three behaviours that keep it honest
| Situation | What happens |
|---|---|
| A second click on the same link | Recognised as already opted out. Nothing is recorded twice and the page says so. |
| A link whose send record no longer exists | The same page, marked as an unrecognised link, rather than an error. |
| An opt-out that succeeds | The address, the organisation, the sequence and the source are all recorded, and the event is logged. |
Recording the source matters more than it looks. An address that opted out through a link, one that was suppressed for bouncing and one that an administrator removed are three different facts, and collapsing them into a single opted-out flag loses the ability to answer why somebody stopped receiving your email.
Around the edges of consent
The unsubscribe path is complete and correct. What organisations ask for is finer control over what somebody is unsubscribing from, and a clearer view of who has.
Preferences rather than all-or-nothing
Opting out of one sequence while staying on another, for recipients who want the operational mail and not the marketing.
A suppression view
Who has opted out, when, from which sequence and through which route, in one place rather than as a flag on a record.
A consent record
When and how an address was added, kept alongside the opt-out, so the whole consent history is one story.
We publish scope, not dates.
Scope lifecycle emailFive questions to ask about an unsubscribe link
How many clicks does it take?
A good answer sounds like
One.
What ours actually is
One. The opt-out happens on the click; the page that follows confirms it and offers a way back.
Does it need a login?
A good answer sounds like
No.
What ours actually is
No. A signature on the link is what authorises it, so the identifier cannot be swapped for somebody else's.
Does the mailbox provider's own button work?
A good answer sounds like
Yes, through the standard mechanism.
What ours actually is
Yes — there is a dedicated endpoint the provider calls directly, deliberately exempt from the cross-site protection that guards browser forms.
What happens if somebody clicks twice?
A good answer sounds like
Nothing bad.
What ours actually is
The second click is recognised as already opted out. Nothing is recorded twice.
Is it recorded why somebody left?
A good answer sounds like
The route, at least.
What ours actually is
The address, the organisation, the sequence and the source are recorded, and the event is logged.
Our take
Unsubscribe is the one feature in email where every instinct towards care makes the outcome worse. Confirming the intent produces spam reports. Requiring a login produces spam reports. Making it a support request produces spam reports and a support queue. The correct implementation is the least defended one — a single click, no account, a signature to stop it being abused, and the reversal offered afterwards rather than the action gated before it. What is genuinely worth engineering attention is not the flow but the failure mode: an unsubscribe that quietly stops working looks identical to one that works, from every angle except the recipient's. That is the case for treating it as a compliance path with its own reasoning rather than as one more public page.
What AWRA OpsHub does today
- A one-click unsubscribe that opts the recipient out on the click itself, with a confirmation page offering a way back.
- A dedicated endpoint for the mailbox provider's own unsubscribe control, exempt from browser cross-site protection because the request comes from the provider rather than from a session.
- Every one of these routes signed, so the identifier in the address cannot be swapped to affect somebody else's subscription or activity.
- Rate limiting on the unsubscribe, one-click and resubscribe endpoints.
- A cross-organisation lookup declared explicitly, because the link carries no organisation and a lookup that failed closed would leave the recipient subscribed while the page reported success.
- A second click recognised as already opted out, so nothing is recorded twice.
- An unrecognised link rendering the same page rather than an error.
- The address, organisation, sequence and source recorded on opt-out, so the reason somebody stopped receiving email is answerable.
- A resubscribe path from the confirmation page.
- Open and click tracking through signed endpoints, with a transparent single-pixel image.
More we can add to your workspace
- Preference-level opt-out, letting a recipient leave one sequence and stay on another rather than choosing between everything and nothing.
- A suppression view, showing who has opted out, when, from which sequence and through which route, in one place.
- A consent record alongside the opt-out, capturing when and how an address was added so the whole history reads as one story.
- A reason captured at the point of unsubscribe, offered rather than required, which is the cheapest market research available.
- Bounce and complaint handling folded into the same suppression list, so every reason an address should not be written to lives in one place.
- A per-recipient send history, so somebody asking why they received a message can be answered precisely.
Where we point you to a specialist
- We will not put a confirmation step, a login or a support request between a recipient and their unsubscribe. Every one of those converts somebody who wanted to leave into somebody who reports you as spam, and that cost lands on every message you send afterwards.
- What consent you need before emailing somebody, and what your unsubscribe must offer, is governed by the marketing and data protection law where your recipients are — which is frequently not where you are. Your advisers own that; we provide the mechanism and record what happened.
- We will keep the opt-out immediate rather than queued for review. An unsubscribe that waits for a person to approve it is an unsubscribe that has not happened, and the recipient has no way of telling the difference from a broken one.
A suppression view is the contained piece here — every opt-out already records the address, the organisation, the sequence and the route, so collecting them into one screen is reporting rather than new machinery.
Click your own unsubscribe link
It is the single most useful five minutes anybody sending automated email can spend, and almost nobody has done it since the day it was built.
Talk through lifecycle emailFrequently asked questions
Why does the unsubscribe happen before I confirm?
Because a confirmation step is where people give up and use the spam button instead, and because mailbox providers treat a single click as the whole contract. The page you land on tells you it has happened and offers to resubscribe, so the reversible direction is the one that costs an extra click rather than the irreversible one.
Can somebody unsubscribe me by guessing a link?
No. Every one of these addresses is signed, so an identifier changed by hand fails verification before the page runs. That signature is what makes it safe to have no login on a page that changes somebody's subscription.
Does the unsubscribe button in my mail client work?
Yes, through a dedicated endpoint the provider calls directly rather than through a browser. Because that request carries no browser session, it is deliberately exempt from the cross-site protection that guards ordinary forms — a narrow exemption with a specific reason, and the only route in the product where a request with no session and no token is the right thing to accept.
What happens if the link is old and the record is gone?
The same page renders, marked as an unrecognised link, rather than producing an error. That matters because a broken-looking unsubscribe page is indistinguishable to the recipient from a sender ignoring them, and the reaction to both is the same.
Can I unsubscribe from one kind of email and not another?
Not today — the opt-out applies to the automated sequences as a whole. Preference-level opt-out is the first item on the list above and is the request that comes up as soon as a workspace runs more than one sequence, because the recipient who wants the operational mail and not the marketing currently has to choose.
How would we know if unsubscribe stopped working?
That is the hard question, and it is the reason the cross-organisation lookup is written explicitly rather than left implicit. A broken unsubscribe renders a normal-looking page while leaving the recipient subscribed, and the only party who knows is the person clicking it every week. Clicking your own link occasionally is a genuinely useful habit.
