Guest access

Guests interact with their conversation without ever creating an account. Pigeon keeps this private and spam-resistant using signed access tokens.

How tokens work

• When a guest needs a link, Pigeon mints a random token and stores only a hash of it — the raw token is only ever sent by email.
• Each token is scoped to a single thread. Opening /pigeon/t/<token> resolves the participant and shows only that conversation — a token can never reach another thread.
• Tokens have a sliding expiry (configurable, 30 days by default, measured from the last activity). Every notification email includes a fresh link, so guests always have a working one.

Expired links

If a guest opens an expired or invalid link, they’re shown a short form to request a new one. Pigeon emails a fresh link to the address on file for any matching open conversation — it never reveals whether an email exists, avoiding enumeration.

Anti-spam

Guest-facing forms (start, reply, request-link) are protected by:

• Per-IP rate limiting — a fixed window you configure in settings.
• An optional honeypot field — submissions that fill it are silently dropped.
• CSRF protection on every form (standard Craft csrfInput()).

Privacy

Guests only ever see normal messages — internal notes are never included in their view or notifications. Because the conversation is scoped by the token, a guest can’t list or guess other threads.