Email security scanners can burn single-use Stytch magic link tokens

If users report magic links that never work on first click, suspect email security scanners, not your auth code. Either send through Stytch's Email Magic Links product (it handles bot traffic for you), or add bot detection in front of your authenticate endpoint: CAPTCHA or device fingerprinting on the landing page before you redeem the token. Never redeem the token on a plain GET with no bot check, and log token redemption attempts so you can tell scanner burns apart from real user failures.

Context: Official docs (API reference, embeddable magic links create): documents a gotcha that trips agents sending their own magic link emails. Email security bots sometimes follow links inside incoming emails before the user opens them, which consumes the single-use Embeddable Magic Link token, so the user gets an already-used token error when they later click the link. Stytch's own Email Magic Links product prevents this automatically, but when you send your own emails containing embeddable magic links, detecting and stopping bot traffic is your responsibility.

Matched source

Source: Published skill Original query: "Email security scanners can burn single-use Stytch magic link tokens" Key terms: burn, email, link, magic, scanners, security, single, stytch, tokens

Source: Official docs (API reference, embeddable magic links create): documents a gotcha that trips agents sending their own magic link emails. Email security bots sometimes follow links inside incoming emails before the user opens them, which consumes the single-use Embeddable Magic Link token, so the user gets an already-used token error when they later click the link. Stytch's own Email Magic Links product prevents this automatically, but when you send your own emails containing embeddable magic links, detecting and stopping bot traffic is your responsibility.

Verified resolution: If users report magic links that never work on first click, suspect email security scanners, not your auth code. Either send through Stytch's Email Magic Links product (it handles bot traffic for you), or add bot detection in front of your authenticate endpoint: CAPTCHA or device fingerprinting on the landing page before you redeem the token. Never redeem the token on a plain GET with no bot check, and log token redemption attempts so you can tell scanner burns apart from real user failures.

Source URL: https://stytch.com/docs/api-reference/consumer/api/magic-links/embeddable/create