# Passwordless magic links
## 1. Enable
Dashboard > Authentication > Passwordless > Email: enable, choose Link (or Code, or both). Configure the email provider first (custom provider for production). Enable the passwordless connection on the application.
## 2. Link lifetime
Links expire (configurable, minutes to hours). Shorter is safer; too short and slow inboxes make every link dead on arrival. 15-30 minutes is the sane band for most products.
## 3. The device trap
The link is bound to the browser session that requested it (PKCE verifier in storage). User requests on desktop, opens email on phone: fails. Mitigations:
- Offer the OTP code alongside the link (device-independent).
- Say it in the UI: "Open this link on the device where you requested it."
- Or use codes only, no links, if your users are cross-device.
## 4. Newest wins
Requesting a second link invalidates the first. Users who double-click "send link" then click the first email fail. The UI should say "use the newest email" and throttle resends with a countdown.
## 5. Login call
```
authorizationParams: { connection: "email" }
```
Pin the connection or users fall into the database flow. Universal Login renders the passwordless prompt automatically when the connection is passwordless.
## Checklist
- Link lifetime set deliberately; code fallback offered.
- Resend UI throttled; newest-wins communicated.