Documentacion renderizada
Esta pagina renderiza Markdown y Mermaid del modulo directamente desde la fuente publica de documentacion.
Overview#
Magic links provide a secure, passwordless authentication method that eliminates the need for users to remember complex passwords. Users enter their email address and receive a one-time login link that grants instant access to their account. This streamlined authentication flow reduces login friction while maintaining enterprise-grade security through cryptographically signed tokens and device fingerprinting.
Key Features#
Email-Based Passwordless Login#
Secure, one-time login links delivered directly to users' email addresses. Users click the link and are instantly authenticated without entering any credentials. Professional HTML email templates with clear call-to-action, security notices, and fallback plain text versions.
One-Time Link Security#
Single-use, time-limited authentication tokens that automatically expire after one successful use or after a configurable timeout, whichever comes first. Tokens can only be used once, preventing replay attacks. Automatic cleanup of expired tokens maintains data minimization compliance.
Redirect URL Support#
Optional redirect URLs automatically navigate users to their intended destination after successful authentication. Strict whitelist-based domain validation prevents open redirect vulnerabilities. Deep link support preserves query parameters and application-specific URLs across the authentication flow.
Automated Token Cleanup#
Automatic cleanup of expired and used tokens minimises security exposure. Expired tokens are removed promptly, while used tokens are retained for a configurable period for audit compliance before automatic deletion.
Attack Prevention#
Token enumeration prevented through hashing, timing attacks mitigated with constant-time comparisons, and brute force attempts blocked through rate limiting. Per-IP and per-email rate limits prevent abuse while maintaining usability for legitimate users.
Use Cases#
- Frictionless User Onboarding: New users authenticate without creating passwords, reducing abandonment and support tickets.
- Protected Resource Access: Users attempting to access protected pages receive magic links that return them to their intended destination after authentication.
- Mobile Authentication: Magic links work seamlessly across devices without requiring password managers or credential storage.
Integration#
Available through authentication API endpoints with request and verification operations. Supports redirect URL preservation, device fingerprinting, and comprehensive audit logging. Integrates with transactional email services for reliable delivery tracking.
Last Reviewed: 2026-02-05