Magic link
Logging in by clicking a one-time link emailed to you. Owning the inbox is the whole password.
See it
What it is
A magic link replaces the password with proof that you control an inbox. The user types an email address, you mint a single-use token, email a URL containing it, and the click exchanges that token for a session. Signup and login collapse into the same screen, and you stop storing password hashes or running a reset flow.
Good fit for low-frequency B2B tools, dashboards, and anything where the account is already tied to a work email. Bad fit when logins happen many times a day, when email delivery is shaky, or when the audience lives behind an aggressive corporate mail gateway. Keep the token short lived (10 to 15 minutes), single use, and bound to the request that started it.
The gotcha that eats teams alive: link scanners. Outlook Safe Links, Proofpoint, and Gmail prefetchers will GET your URL before the human does, burning the one-time token and showing a real user 'this link has expired'. Defenses are a POST-on-confirm interstitial page instead of an instant GET login, and a matching numeric code shown in the browser so the user can finish in the tab they started in. Also remember that whoever owns the inbox owns the account, so email security becomes your security.
Ask AI for it
Build a magic-link login flow. On email submit, always show the same 'check your inbox' screen whether or not the account exists. Generate a single-use login token from a CSPRNG plus a separate transaction ID. Store only the token hash, the expiry (15 minutes), and a used flag, and set the transaction ID in the initiating browser as an HttpOnly, Secure, SameSite cookie so you can tell later whether the click came back to the tab that started it. Email the link carrying the token. GET must render a confirmation page and change nothing, so inbox link scanners cannot burn it; consume the token atomically on POST, in a single conditional update that fails if it was already used. If login has to finish in the original tab, email a short code as well and have the user type it there, verified against the same token record. Record the request IP and user agent as risk signals only, and never hard-bind completion to them, since mobile networks and mail proxies change both. Rate limit requests per email and per IP, invalidate all outstanding tokens on successful login, and handle the expired-link case with a one-click resend.