I guess it's added as an additional security check. This would be applicable to all codes though. I propose in ClientSessionCode#getAction we create a new key and set it on the ClientSession. Then we add the key to the signature part of the code. This would make each code more unique and harder to generate, while at the same time we could remove the key query param for emails. ----- Original Message -----