Sign users in with an emailed link
Authentication that demands a memorized password is a memory test, and G218 offers a route around it. Send a sign-in link to the reader's email address, and activating it logs them in. W3C lists it as sufficient for 3.3.8 Accessible Authentication (Minimum) at Level AA and again for the enhanced version at Level AAA, and those two criteria share the same short list of two techniques. One check separates them. At the higher level the process must also use no object recognition test, so no picking out the traffic lights. Security is explicitly out of scope on W3C's page, though it notes the mechanism usually involves a time-limited token. W3C's own example puts the link inside the forgotten-password flow. Offering it as a first-class option is better, because a route only reachable by declaring failure is a route most people will not take.
How we find it in an audit
Our reviewers attempt a real login using only the email route. Request the link, receive it, open it. Then check it signs them in with no further memory test. Then we look at the ordinary login for the things that make it a test, a code that must be retyped inside sixty seconds, or a paste block that forces manual transcription from a password manager.
How affected users experience it
Retyping a six-digit code inside sixty seconds is a different task through a screen reader, because hearing the code, holding it, and finding the field all take time the timer does not allow. People with cognitive disabilities and memory impairments face the same wall on the password itself. Blocking paste removes the one tool that solved it. A link they can activate turns the whole obstacle into a single action.
Passes vs. fails
Passes
'Email me a sign-in link' sits beside the password box, and activating the link in the inbox completes login on its own.
Fails
Login demands a memorized password plus a 6-digit emailed code retyped within 60 seconds, and blocks pasting into both fields.
Other ways to satisfy this rule
3 guides on this site are filed under 3.3.8 Accessible Authentication (Minimum). W3C lists this one as sufficient for that rule on its own. Implement it correctly, in a way your readers' software actually supports, and the rule is met.
This guide is our interpretation of W3C technique G218: Email link authentication. W3C publishes its techniques as guidance rather than as the standard, and says so on every one of them. The success criterion is what conformance is measured against, and a technique is one documented way to meet it.