Imagine you are a cab company that subcontracts independent drivers to drive within certain cities and towns.
You send the subcontractor a link to a page that has fields for the subcontractor to enter and submit information (such as how much money they made on a job they were asked to do, or comments about the job). The subcontractor doesn't need credentials (an account with username and password) to access this link. They just need the link, which is specifically meant for them, and which has a query string parameter that is a randomly generated access token. The subcontractor entering and submitting information from the page led to by the link sends data to the company's database.
This access token at the end of the URL is meant to keep the page secure and accessible only by the subcontractor. The access token is also time based. The subcontractor has 24hrs to enter the information from that link.
What is your opinion? How secure is this? This reminds me of the password reset links that websites send out. What if instead of 24hrs the link lasted for 1 month?