add-classroom-pin

What problem does it solve?

Class-token URLs issued by the /add-classroom skill are bookmarkable and reusable, allowing a student to forward their login link to an unauthorized user who can then log in as them. This skill closes that security gap by adding a 6-digit PIN verification step that requires access to the student's registered school email to complete login.

Core Features & Use Cases

• Email PIN 2FA: Gates first-device class-token login behind a 6-digit PIN sent to the student's school email, blocking access for anyone without inbox access.
• Rate Limiting & TTL: PINs expire after 10 minutes and allow only 3 verification attempts to prevent brute force attacks.
• Seamless Integration: Works with existing /add-classroom and /add-resend skills, modifying the class-token redeemer flow to redirect to a PIN entry page instead of issuing a session cookie immediately.
• Use Case: Instructors issuing class-token login links for student playground access can prevent students from sharing their bookmarkable links with peers, ensuring only the intended student can log in.

Quick Start

Use the add-classroom-pin skill to add email PIN 2FA to your existing class-token login flow to block unauthorized access from shared bookmark URLs.