Full disclosure, I work for a fully-fledged authentication solution (FusionAuth) and if your PoC succeeds, my guess is you'll look to make a move to a similar solution. But I understand your desire to go quick and dirty.
You didn't provide a ton of details (the programming language affects library options, for example) but I would go one of the following ways:
* login with a social provider like google, facebook or github. I don't know what your audience is, but hopefully you know which of these (or any other) would have the most uptake. This delegates the entire authentication process to a third party and allows the user to choose the level of security they want around their account without involving you at all.
* look for an OSS library in your language that offers magic token login. This is what you are describing when you talk about the token. Implement that. If you can find such a library, this will be a simpler solution.
> What is the better way to implement this? Should I stick to the plain old login-password combination?
I'm not your user and we don't have any idea what your userbase is. I'd ask them. Lots of tech folks want a username and password so they can use a password manager. Non-tech folks would probably prefer one of the two above options.