Magic links

Magic links provide a simple email-based login flow with secure, time-limited tokens.

How magic links work (default hosted flow)

Magic links are the default passwordless flow in the hosted Authalla UI. When a user enters their email and submits the sign-in form, Authalla starts a login session and sends an email that includes both:

• A 6-digit PIN.
• A magic link.

Both expire after 10 minutes.

Users can either enter the PIN or click the magic link to finish authentication. On success, they continue straight to your app. With passkeys on, the PIN page also offers to create a passkey, saved when the right PIN is entered or the link is opened in the same browser (see Passkeys).

Security properties

• A magic link works once, for 10 minutes, and only on the tenant that sent it.
• Signing in with the PIN or the link ends both, and so does requesting a new email: an older email, forwarded or opened later, signs no one in.
• A PIN allows 5 wrong guesses, and sign-in emails to one address are rate limited.
• Authalla stores only a hash of each link, so its database holds no link that works.

Configure email templates

Customize sender details and branding in the Admin UI. Link and PIN lifetimes are fixed.

Deliverability tips

• Use a verified domain.
• Configure SPF and DKIM for your email provider.