Access via link in Email - How can I make this most secure?

Question

I need your professional opinion on this matter, please.

The app I'm building has 2 parts: Teachers & students.
Teachers use the app to build a project and attach students to it.
Then, the students access the project in our system and complete some tasks.

We don't want the users to register or use an existing account (via oAuth2). We simply want them to have a quick and simple way of getting in the system, with as little setup as possible.
Should be noted that we need to allow multiple entries from different locations.
Each student will have multiple "access points", one for each project he's attached to.

The reason we care so little about the possible thefts that can occur is that the students have very limited possibilities, and the data that is shown to them isn't confidential.

I can think of 2 suitable options:

1. Send the student an email with a link that contains an access key, for example: example.com/students/skfn38rhsah93e2dsasdsd2.
   The link will not expire.
2. Send the student an email with a link and a short access key which will be required by the link, for example:
   Link: example.com/students/dfwkl4tihifhdso03n
   Access Key: A7F21D

The 2nd option is more secure because the 1st will get saved in browser history, sent in the http referrer and generally exposed. Using the 2nd option insures that whoever accesses the link has/had access to the Email account. However, it is a slightly longer process for the student.

So my questions are:

1. Is the added security the 2nd option delivers worth the longer process, in your opinion? I know this is a subjective question, but your opinion means a lot to me.
2. If you think the 1st option's better, how long should the access key be?
   I want to embed the student ID and the project ID inside it, so I was thinking about using JWTs, but they are 220 characters. Is it too much? (URLs can contain up to 2000).
3. If you think the 2nd option's better, how long should the access key be?
   How should I design the link? Same as in the first option? (using a JWT)
4. Is there a better way?

Thanks for helping!

Note: I'm planning on using SSL, just FYI.

Answer 1

1. Is the added security the 2nd option delivers worth the longer process, in your opinion? I know this is a subjective question, but your opinion means a lot to me.

You correctly saw the security it could cause with the browser history. Only you can determine if it worth it.

However, instead of some random string sent by email, which will mostly force the students to find the email upon each connection, you may ask for some information they may already know or is more easily reachable to them (last numbers of the student ID, something like the birth date, etc.).

2. If you think the 1st option's better, how long should the access key be? I want to embed the student ID and the project ID inside it, so I was thinking about using JWTs, but they are 220 characters. Is it too much? (URLs can contain up to 2000).

If possible, I would avoid to put any information in the access key but use a random string instead. Then, on server-side, you can have a database which will associate this random access key to the information you want (student ID, etc.). By this way, given one link, it will not be possible for the students to guess other valid links.

Concerning the length, around 20 characters as you have now seems fine.

I think this also answers to your two last questions.