---
title: "Expiring Confirmation Links"
manual: "Femanager"
version: "14.1"
permalink: "https://docs.typo3.org/permalink/in2code/femanager:confirmationlinkexpiry@14.1"
source: "Features/ConfirmationLinkExpiry/Index.rst"
rendered: "2026-11-12T07:32:49+00:00"
---

# Expiring Confirmation Links {#confirmationlinkexpiry}

## Basics {#basics}

Every link femanager sends by email carries a signed expiration date and stops working once that date has
passed. This applies to all four workflows:

-   the double-opt-in link the newly registered user receives,
-   the confirmation and refusal links the administrator receives for a registration,
-   the confirmation and refusal links the administrator receives for a profile change,
-   the invitation link.

The default lifetime is one day. Setting the lifetime to `0` disables the expiration, which restores the
behaviour of femanager 13 and earlier, where a link stayed valid forever.

The expiration date is part of the signed value, so it cannot be manipulated. No database field is involved and
nothing has to be cleaned up.

Besides the expiration date the signature is bound to the uid of the user and to the workflow step the link
belongs to, so a link works neither for another user nor for another step. The uid and not the username is
signed, because TYPO3 does not enforce unique usernames. Renaming a user therefore keeps the links already sent
to them working until they expire.

Note: opening a form with a valid link issues a fresh link for the form itself, so filling in the invitation
form or the confirmation dialog cannot fail because the original link expired in the meantime.

## TypoScript Settings {#typoscript-settings}

The lifetime is configured per workflow, in seconds:

```typoscript
plugin.tx_femanager {
	settings {
		new {
			# Seconds a registration confirmation link stays valid. 0 lets the links never expire.
			confirmationLinkLifetime = {$plugin.tx_femanager.settings.new.confirmationLinkLifetime}
		}
		edit {
			# Seconds a profile change confirmation link stays valid. 0 lets the links never expire.
			confirmationLinkLifetime = {$plugin.tx_femanager.settings.edit.confirmationLinkLifetime}
		}
		invitation {
			# Seconds an invitation link stays valid. 0 lets the links never expire.
			confirmationLinkLifetime = {$plugin.tx_femanager.settings.invitation.confirmationLinkLifetime}
		}
	}
}
```

## What happens when a link expired {#what-happens-when-a-link-expired}

-   ****Registration****

    The visitor gets the message `confirmationLinkExpired` and is sent to the resend dialog, where a new
    confirmation mail can be requested with the email address. See [Resend User Confirmation Request](https://docs.typo3.org/permalink/in2code/femanager:resenduserconfirmationrequest@14.1). An
    administrator can trigger a new mail from the backend module, and the command
    `femanager:sendUserConfirmationReminder` does the same for all users whose registration is still
    unconfirmed.

-   ****Profile change****

    The administrator gets the message `confirmationLinkExpiredUpdate`. The pending change is kept in
    `tx_femanager_changerequest`, so nothing is lost - the user can submit the change again, which sends a new
    request mail.

-   ****Invitation****

    The invited user gets the message `confirmationLinkExpiredInvitation`. There is no self-service here, an
    administrator has to invite the user again.

The three messages are regular labels in
[`EXT:femanager/Resources/Private/Language/locallang.xlf`](https://docs.typo3.org/m/typo3/reference-coreapi/master/en-us/ExtensionArchitecture/FileStructure/Resources/Private/Language.html#file-extension-resources-private-language-locallang-xlf) and can be overridden like any other label.

## Telling the recipient how long a link works {#telling-the-recipient-how-long-a-link-works}

The mail templates that contain a workflow link receive the variable `{linkValidUntil}`, a `DateTimeImmutable`
holding the moment the links stop working. It is empty when the links never expire. Use it in your own templates
like this:

```html
<f:if condition="{linkValidUntil}">
    This link is valid until <f:format.date format="d.m.Y H:i">{linkValidUntil}</f:format.date>.
</f:if>
```

## Rate limiting {#rate-limiting}

Requesting a new confirmation mail is subject to the same rate limiter as the registration itself, see
[Rate Limiter](https://docs.typo3.org/permalink/in2code/femanager:ratelimiter@14.1).