3.10.0

Improvements

• Added LoginLinkAuthenticator to work with Authentication plugin and allow one time tokens to be used

$service->loadIdentifier('Tools.LoginLink', [
    'resolver' => [
        'className' => 'Authentication.Orm',
    ],
]);

// Session, Form, Cookie first
$service->loadAuthenticator('Tools.LoginLink', [
    'urlChecker' => 'Authentication.CakeRouter',
    'loginUrl' => [
        'prefix' => false,
        'plugin' => false,
        'controller' => 'Account',
        'action' => 'login',
    ],
]);

Then just use Tools.Tokens to generate and send a login link, and once they click it they should auto-login.
See docs for details.