Magic Link
A passwordless authentication method that sends a unique, single-use URL to the user's email or phone, allowing them to log in with a single click without entering a password.
What is Magic Link?
Magic link authentication is a passwordless login method where users receive a unique, time-sensitive URL via email or SMS. When clicked, this link contains a cryptographic token that automatically authenticates the user without requiring them to enter a password. The link typically has a short expiration time (5-15 minutes) and can only be used once. Magic links are part of the broader passwordless authentication ecosystem and are particularly popular for consumer-facing applications where reducing login friction is prioritized. They eliminate password-related security risks like weak passwords, password reuse, and phishing, while providing a seamless user experience.
Analogy
Think of a magic link like a VIP pass sent to your email. Instead of remembering a secret password to get into an event, you just show the special pass (click the link) that was sent directly to you, and the bouncer lets you in instantly.
Types and Use Cases
Types of Magic Links:
- Email-Based Magic Links: Sent to user's registered email address with embedded token
- SMS-Based Magic Links: Delivered via text message (less common due to URL rendering issues)
- QR Code Magic Links: Generated for mobile app login from desktop browsers
- Cross-Device Magic Links: Allow login on one device using link opened on another
Common Use Cases:
- Consumer applications prioritizing low-friction onboarding
- Password reset flows as a secure alternative to temporary passwords
- Re-engagement campaigns with direct login links
- Mobile app login from desktop web browsers
- Temporary access grants for partners or contractors
How it Works
{
"magicLinkRequest": {
"email": "user@example.com",
"token": "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9...",
"expiresAt": "2025-03-05T10:45:00Z",
"oneTimeUse": true,
"redirectUrl": "https://app.example.com/dashboard"
},
"tokenPayload": {
"sub": "user_12345",
"email": "user@example.com",
"iat": 1709631000,
"exp": 1709631900
}
}Magic Link vs OTP (One-Time Password)
Magic Link
OTP (One-Time Password)
Magic links require only one click to authenticate,
OTP requires copying and typing a code
Magic links can be intercepted if email is compromised,
OTP (especially TOTP) requires physical access to the device
Magic links provide better UX for desktop users,
OTP works better for mobile-first applications
Best Practices for Magic Link
- Short Expiration Times: Set magic link expiration to 5-15 minutes to minimize window for interception or token reuse
- Single-Use Tokens: Invalidate tokens immediately after first use to prevent replay attacks
- Secure Token Generation: Use cryptographically secure random generators and hash tokens before storing in database
How LoginRadius Powers Magic Link
LoginRadius supports magic link authentication as part of its passwordless login suite. The platform allows you to enable magic links for both login and registration flows, with configurable expiration times, custom email templates, and automatic fallback to OTP if needed. Magic links can be combined with LoginRadius's risk-based authentication to require additional verification for unrecognized devices.
FAQs
If an attacker has full access to your email account, they can use magic links to log in. This is why magic links should be combined with additional factors (like device recognition or MFA) for sensitive accounts. However, magic links are still more secure than weak or reused passwords, which are commonly compromised through phishing or breaches.
Yes, magic links are often used in registration flows. After a user provides their email, a magic link can verify the email address and simultaneously create the account and log them in. This eliminates the need for users to create and remember a password during signup.
The system should display a clear error message explaining that the link has expired and provide an option to request a new one. Best practice is to automatically redirect to a 'link expired' page with a prominent 'Send New Link' button, maintaining a smooth user experience even in error cases.