Using a ticket based authentification is implicit:
Tickets access url may be provided as links in notification mails, or as links in some other content addressed to the user. User that have the link url may just browse to this url.
Users should be informed that a ticket access link is personal and contains a direct way to access a moodle session on behalf of the ticket internal encoded username. Thus users should NEVER give those url to third party users, not publish it in a publicly accessible content.
Integrators and administrators should read the additional security discussion in the Integrator Guide for more details about security handling.
When working with moode integrated shop, when sending a quote or an invoice to the customer, the auth ticket is used to provide the purchaser a long term access ticket to upload his generated documents, whithout necessarily having to log in again in moodle. The acces point with embedded generated ticket will be part of the notification email.
The auth/ticket access point should e used in HTTPS to avoid any interception of ticket value.