Websites · Glossary
What is a magic link?
A magic link is a single use sign in link sent to a person's email address. Clicking it proves they control that inbox and signs them in without a password. The link carries a token that expires after a short time and works once, so anyone who later finds the email cannot reuse it.
Magic links swap something you know, a password, for something you have, your inbox. They remove forgotten passwords but tie every sign in to email arriving quickly.
Nuwan Madhusanka · Co-founder
4 min read · Published
| Question | Magic link | Email and password | Sign in with Google |
|---|---|---|---|
| What the person needs | Access to their email inbox | A password they remember or store | A Google account |
| Speed of sign in | Slower; wait for the email | Fast once remembered | Fast; one tap if signed in to Google |
| Forgotten password problem | None | Needs a reset flow | None |
| Main risk | Email account takeover, delayed or filtered email | Weak or reused passwords | Google account takeover |
| Works on shared computers | Yes, if the inbox is open there | Yes | Yes, if signed in to Google there |
What it is
A magic link is a passwordless sign in method. The person types their email address, the site sends an email with a link, and clicking it signs them in. Behind the link is a random token stored, or signed, by the site's authentication system, tied to that address and an expiry time. Supabase Auth, for example, sends magic links by default from its sign in with OTP method, and its documentation says that by default a person can request a link once every 60 seconds and links expire after one hour. The same flow can send a six digit code instead of a link.
How it works
After the person submits their address, the auth system creates a token and emails a link containing it. When the link is opened, the server checks the token is valid, unexpired and unused, marks it used, and starts a session, usually by setting a cookie or returning access and refresh tokens. If the address has no account, many systems create one, which makes magic links double as sign up. Because the link opens in whatever browser the email app chooses, a person who requests it on a laptop and opens it on a phone is signed in on the phone.
When it matters
Magic links suit sites people visit now and then, such as a club's members area, a customer portal or a booking history, where a password would be forgotten between visits. They reduce support requests for password resets and remove the risk of reused passwords. They suit staff tools less, where people sign in daily and waiting for email slows them down, and sites whose audience uses work email with strict filtering that may delay or quarantine sign in emails.
Common mistakes
Long expiry times, which leave valid links sitting in inboxes. Links that work more than once. No rate limit, so an attacker can flood someone's inbox. Sending the email from an address without SPF and DKIM, so it lands in spam. Not handling the case where the link opens in a different browser or the email app's preview browser. Leaking the token in analytics or referrer headers. And offering only magic links to people who need to sign in on a device without their email.
Where it shows up in OneCraft
Visitor login on OneCraft sites is email and password through Supabase Auth, with a password reset, plus Google sign in through OneCraft's broker, which works on the published site and the installed app. Magic links are not among the listed sign in methods. Sign in is part of the site's own database, which the agent sets up when a capability needs data, with row level security on every table and access checks run as an anonymous visitor and as a signed in person.
Questions people ask
Are magic links more secure than passwords?
They remove weak and reused passwords, which cause many account takeovers, but they move all the risk to the email account. If someone controls the inbox, they can sign in. For most small sites that is an improvement; for high value accounts, add a second factor whatever the sign in method.
Why did my magic link not work?
Common reasons are that it expired, it was already used, often by an email scanner that opened it first, or a newer link replaced it. Request a fresh link and open it once. If corporate email security opens links automatically, a one time code typed into the site avoids the problem.
Is a magic link the same as a one time password?
They solve the same problem. A magic link carries the token in a URL you click; a one time password is a short code you type into the site. Codes work better when the email is read on a different device from the one signing in.
Do magic links work on mobile apps?
Yes, if the app handles the link. The link must open the app rather than the browser, which needs a universal link on iPhone or an app link on Android, or the app can ask for a typed code instead. Without that, the link signs the person in on the browser, not in the app.
Can I use magic links and passwords together?
Yes. Many sites offer both: a password for regular users and a magic link or code for people who forgot theirs or prefer not to use one. The account is the same either way, keyed by the email address, so a person can switch methods.
Make one with websites
The button opens the generator with this use case already described. Change the wording to match your own.
Create a website with OneCraftRelated questions
- What is OAuth?What is OAuth? The framework behind Sign in with Google: the four roles, how the code flow works, how OpenID Connect adds identity, and common mistakes.
- What is an admin role?What is an admin role? A role that grants management rights on a site or app, enforced by the database rather than the menu, with member and admin compared.
- What is row level security?What is row level security? Database policies that decide which rows each signed in person can read or change, with common policy shapes and how to test them.
- What is a TXT record?What is a TXT record? A DNS record that holds text, used to prove you own a domain and to publish SPF, DKIM and DMARC email rules, with examples.
Written and checked by the OneCraft team. Last checked .