Passwordless would allow you to do that quite easily. Only risk are the shorter tokens (can be balanced by shorter validity, though). There is a short description of how to do it in the documentation