Workplace access links
How organisations interact with invoices and bookings by email, and how you respond.
What a workplace access link is
Every invoice email and booking-confirmation email Sessional sends on your behalf carries a 30-day signed URL. The recipient clicks through and sees a Sessional-branded page with the invoice or booking detail. No account creation, no login, no password. The URL itself is the authentication.
Invoice URLs end in /w/inv/<token>. Booking URLs end in /w/bkg/<token>. Booking-schedule URLs end in /w/bc/<token>.
What the organisation can do
How Mark paid actually works
This two-step flow keeps your records clean. The finance team can be wrong about the invoice, the amount, or the reference. Mark paid is a signal, not an automatic state change.
How disputes work
A dispute from the organisation does three things.
- Creates an open dispute record on the invoice or booking
- Pauses the auto-chaser cron while the dispute is open
- Sends you an in-app notification
You can accept the dispute and re-issue, or reject it and let the reminders resume.
Revoking a link early
Every invoice row has a Revoke workplace access link button. Use it if you sent the invoice to the wrong email address or need to withdraw the link early. You can restore it with the same button.
Booking schedules work the same way. The Booking schedules sent panel on the Bookings page lists every schedule you have emailed to an organisation, each with a Revoke link control (and Restore link to undo). A revoked schedule link shows the organisation a withdrawn message and can no longer be acknowledged.
Security model
Workplace links are signed on Sessional's servers with an HMAC secret and an expiry. They cannot be forged or guessed.
If the recipient forwards the link, anyone with the URL can view that invoice or booking, but nothing else in your account.