diff --git a/api/utils/appointment_mail.py b/api/utils/appointment_mail.py
index ec9bcb3..4491a6f 100644
--- a/api/utils/appointment_mail.py
+++ b/api/utils/appointment_mail.py
@@ -5,6 +5,7 @@
 
 from experiments.emails import ConfirmationEmail
 
+from api.auth.models import UserToken
 from experiments.models import Experiment, TimeSlot
 from participants.models import Participant
 
@@ -19,10 +20,6 @@ def get_initial_confirmation_context(experiment: Experiment) -> dict:
         'leader_email': experiment.leader.api_user.email,
         'leader_phonenumber': experiment.leader.phonenumber,
         'all_leaders_name_list': experiment.all_leaders_str,
-        'cancel_link': parse.urljoin(
-            settings.FRONTEND_URI,
-            'participant/cancel/'
-        ),
     }
 
     if experiment.location:
@@ -42,9 +39,20 @@ def send_appointment_mail(
     if participant.email is None:
         return
 
+    # create login token for cancelation link
+    token = UserToken.objects.create(
+        participant=participant,
+        type=UserToken.CANCEL_APPOINTMENTS,
+    )
+    cancel_link = parse.urljoin(
+        settings.FRONTEND_URI,
+        "participant/appointments/{}/".format(token.token)
+    )
+
     context = get_initial_confirmation_context(experiment)
     context.update({
         'name': participant.mail_name,
+        'cancel_link': cancel_link
     })
 
     if experiment.use_timeslots:
@@ -65,4 +73,3 @@ def send_appointment_mail(
         context=context,
     )
     email.send()
-
diff --git a/api/views/participant_views.py b/api/views/participant_views.py
index ec21c94..6d15c3d 100644
--- a/api/views/participant_views.py
+++ b/api/views/participant_views.py
@@ -288,4 +288,4 @@ def _get_participant(self):
         raise PermissionDenied
 
     def get_queryset(self):
-        return Appointment.objects.filter(participant=self._get_participant())
+        return Appointment.objects.filter(participant=self._get_participant()).order_by('-timeslot__datetime')