I'm building a site that lets users schedule interviews/conferences with third parties and I'm wondering what's the best way to provide security around the participant experience while providing the smallest usability barrier possible.
Currently, I send an email with a link and a 5 digit auth-code. The link opens a page, the participant types in the auth-code and is temporarily logged in for the duration of the interview/conference.
From a security standpoint, I think the auth-code is redundant and introduces friction for the participant, who may never have cause to visit my site again and may not be technically proficient. The link I send as part of the invitation contains a random string, so I could just increase its length by 5 characters and have the same size search space for potential attackers.
The downside is that I would potentially have to rate-limit the responses for the invitation URLs, so I'm not sure there's any benefit from a complexity/lines-of-code perspective.
The non-auth-code feels less secure, but I know that's irrational. Any thoughts on what the best approach would be?