# Passwordless magic links

## 1. Enable

Dashboard > Authentication > Passwordless > Email: enable, choose Link (or Code, or both). Configure the email provider first (custom provider for production). Enable the passwordless connection on the application.

## 2. Link lifetime

Links expire (configurable, minutes to hours). Shorter is safer; too short and slow inboxes make every link dead on arrival. 15-30 minutes is the sane band for most products.

## 3. The device trap

The link is bound to the browser session that requested it (PKCE verifier in storage). User requests on desktop, opens email on phone: fails. Mitigations:

- Offer the OTP code alongside the link (device-independent).
- Say it in the UI: "Open this link on the device where you requested it."
- Or use codes only, no links, if your users are cross-device.

## 4. Newest wins

Requesting a second link invalidates the first. Users who double-click "send link" then click the first email fail. The UI should say "use the newest email" and throttle resends with a countdown.

## 5. Login call

```
authorizationParams: { connection: "email" }
```

Pin the connection or users fall into the database flow. Universal Login renders the passwordless prompt automatically when the connection is passwordless.

## Checklist

- Link lifetime set deliberately; code fallback offered.
- Resend UI throttled; newest-wins communicated.