Most visitor management systems are designed for office towers: print a sticker, sign an NDA, click through three screens. In a coworking space that's noise. Your members' guests aren't spies; they're a friend's designer and a prospect's ops lead. The job is to make them feel expected, not interrogated.
Magic-link visitor management is the lighter pattern. Member sends an invite, guest gets a single-tap link, link opens the door (or hands a QR to reception). No app to install, no password to forget. This playbook is the recipe: what to put in the invite, how the day-of-visit flow works, what to log for compliance, and how door-access automation will wire in when that integration lands.
The shortest definition. A magic link is a single-use URL that authenticates a guest for a bounded window (typically 90 seconds before their booking, until 90 minutes after).
Section 1
Why magic-link
5 min · theory · members + front desk
Magic-link wins on three dimensions: friction (zero install), security (single-use token tied to a booking), and member trust (the invite carries the member's name, not yours). It loses on one dimension: if the guest's phone is dead, they need a fallback (usually a 6-digit code at reception).
The three flows magic-link replaces
- The clipboard. Paper sign-in sheets. Lose data on day 1; lose compliance on day 8; lose member trust on day 30.
- The visitor app.10MB download, account creation, push permission. Members' guests skip 60% of the time, so reception ends up adding them by hand.
- The pre-printed badge.Works in a tower; doesn't scale to a coworking space with 30+ visitors a day across multiple members.
Flow diagram
Audit your current visitor flow. If it requires the guest to install something, hand them paper, or wait at reception for a person, it's a candidate for replacement.
Section 2
Sending invites
2 min per invite · member side · the member portal
The member sends the invite from the booking confirmation screen: “Add a guest” surfaces an email + phone form. The link is delivered via SMS by default (90%+ open rate inside 5 minutes; email fallback if no mobile country code is set).
What goes in the invite
- Member's name.The invite reads “Sara from Mercer & Co. has invited you to…”, not “LiteHQ has invited you….” The relationship is member-to-guest, not platform-to-guest.
- The room and time.Concrete: “Atrium · 10 Sale St · Tue 21 May · 14:00.” Add a map link, even if the guest has been before.
- The magic link.Big, tappable, “Open door” or “Check in” depending on whether you have access control wired.
- The fallback.A 6-digit code below the link. Reception can verify it manually if the guest's phone is dead.
Sample SMS body
Hi Jamie, Sara from Mercer & Co. has invited you to Atrium at Stretch on Tue 21 May at 14:00. Tap to check in: stretch.co/v/abc-123 (or use code 482-301 at reception). Address: 10 Sale St, Auckland Central.
Send yourself a test invite. Read it on your phone in a hallway. If it doesn't feel like a personal invite from a member, tighten the copy until it does.
Section 3
Day-of-visit experience
90 seconds · front of house · the magic happens here
90 seconds before the booking, the magic link activates. The guest taps it on their lock screen, the link opens to a check-in confirmation, and the host gets a push notification: “Jamie has arrived.” When cloud door-access lands, the door will click automatically at the same moment.
The three modes
- Auto-door (roadmap).Guest taps, door unlocks. The host is pinged but doesn't need to do anything. This mode requires a cloud door-access integration, which is on the roadmap (see Section 5).
- Reception-assisted.Guest shows the open link to the front desk. Receptionist taps “Verify” on the kiosk, door opens. The default for smaller spaces or shared lobbies.
- Self-check (kiosk). Guest scans a QR code on a kiosk, enters the 6-digit code, kiosk prints a name badge. Works without staff for after-hours access.
3-mode comparison
Direct unlock via cloud door-access integration (coming).
Tap on kiosk to verify and admit guest.
QR scan + code, kiosk prints badge.
Decide which mode is the default for your space (most are reception-assisted). Then write a one-line policy for what happens at 10pm on a Saturday, as that's the case that determines whether you need the kiosk mode.
Section 4
Audit + compliance
ongoing · invisible to members · matters when it matters
Every magic-link visit creates an audit row. The host, the guest, the room, the time in, the time out, the verification method (auto-door, reception, kiosk). Exportable as CSV for the cases where you need to hand it to someone (fire marshal, insurer, building manager). Three properties worth knowing about.
The three audit guarantees
- Tamper-evident. Every row is hash-chained. A row deleted out of band breaks the chain and shows up in the next audit export.
- Time-bounded link. The magic-link token is valid only from 90s before booking start until 90 minutes after end. Outside that window the link is a 410 Gone, with no half-stale tokens floating around.
- Privacy-by-default. Visitor emails and phone numbers are stored with a 90-day retention by default. Configurable per-tenant; many operators shorten to 30. After expiry, only the audit-row metadata (room/time/host) remains.
Audit export sample
visit_id, host_member, guest_name, room, time_in, time_out, method v_8a3f, Sara Patel, Jamie Tan, Atrium, 2026-05-21T14:01Z, 2026-05-21T15:42Z, auto-door v_8a40, Sam Lee, Aria Tahir, Forum, 2026-05-21T14:05Z, 2026-05-21T16:11Z, reception v_8a41, Lukas Falk, Mei Hodson, Studio, 2026-05-21T17:32Z, 2026-05-21T18:28Z, kiosk
Open the audit export today, even if you don't need it. Knowing the columns before a real incident saves an hour at the wrong moment.
Section 5
Door-access automation (roadmap)
Not available yet · on the roadmap · Kisi is the first planned provider
Cloud door-access integration is on the roadmap. When it ships, magic-link check-ins will trigger an unlock event automatically with no receptionist needed. Kisi is the first provider planned; the provisioning model will mirror what LiteHQ already does for bookings and memberships.
Today, the equivalent workflow uses reception-assisted or kiosk check-in (Section 3). Every check-in is still logged with a timestamp and guest email, so your audit trail is complete regardless of whether a physical door is automated.
If automated door access matters to your space, email us at hello@litehq.com. Operator demand shapes the roadmap priority.
Set up kiosk check-in (Section 3) as your primary flow for now. When door-access lands, the upgrade path will be a single mapping step in the integrations dashboard.
Section 6
FAQs
reception-ready · printable · 8 questions
The eight questions members and guests ask in month one. Memorise the answers; put them under reception.
The link expired before my guest arrived.
Links are valid from 90s before booking start until 90 minutes after. If the guest is running late, the host can extend from the booking detail screen, which adds another hour.
My guest’s phone is dead.
They give reception the 6-digit code from the printed itinerary, or the host’s name. Reception can verify either way from the kiosk.
Can I invite multiple guests at once?
Yes: type up to 10 emails into the invite form. Each guest gets a unique link tied to the same booking. Audit log records each individually.
Does the guest need to install anything?
No. The link opens in the default browser. No account, no app, no password.
What if the guest declines to share their email?
Send the link via SMS instead. If they decline that too, fall back to a reception-printed itinerary with the 6-digit code.
How long are visitor records kept?
90 days by default; configurable per-tenant down to 7 days. After expiry only the audit-row metadata (room, time, host name) is retained.
Can I revoke a magic link?
Yes: use ‘Revoke link’ on the booking detail. Subsequent taps return 410 Gone and an audit row is written with reason: revoked.
What about minors?
If the guest is under 18, the invite flow flags the host to attach a parental-consent file. Audit row keeps the attachment ID. Defaults are on, configurable per-tenant.
Print this FAQ section and tape it under reception. Add the two questions specific to your space at the bottom; there are always two.
Key takeaways
Five things to keep, even if you remember nothing else.
- Magic links are the lighter pattern. Zero install, single-use, member-branded. Replace the clipboard, the app, the pre-printed badge.
- Invite copy matters.“Sara from Mercer has invited you,” not “LiteHQ has invited you.”
- Three modes. Auto-door, reception-assisted, kiosk. Pick a default; wire the others later.
- Audit is tamper-evident. Hash-chained rows, time-bounded tokens, 90-day default retention.
- FAQ is reception's lifeline. Print it, tape it, update it monthly.