Email security scanners can burn single-use Stytch magic link tokens

TL;DR

Either send through Stytch's Email Magic Links product (it handles bot traffic for you), or add bot detection in front of your authenticate endpoint: CAPTCHA or device fingerprinting on the landing page before you redeem the token.

Steps

1. If users report magic links that never work on first click, suspect email security scanners, not your auth code. Either send through Stytch's Email Magic Links product (it handles bot traffic for you), or add bot detection in front of your authenticate endpoint: CAPTCHA or device fingerprinting on the landing page before you redeem the token. Never redeem the token on a plain GET with no bot check, and log token redemption attempts so you can tell scanner burns apart from real user failures.

When to use

You are seeing this: If users report magic links that never work on first click, suspect email security scanners, not your auth code. Use this skill when you run into "Email security scanners can burn single-use Stytch magic link tokens".

When not to use

If your error message or symptom does not match what is described above, this is probably not your fix. Search for your exact error text instead of forcing this one to fit.

Versions

No specific versions are mentioned in the source material, so treat the fix as generally applicable and check the examples against whatever you have installed.

Why this happens

The original report does not dig into a root cause. It documents the symptom and the fix that resolved it.

Source: Official docs (API reference, embeddable magic links create): documents a gotcha that trips agents sending their own magic link emails. Email security bots sometimes follow links inside incoming emails before the user opens them, which consumes the single-use Embeddable Magic Link token, so the user gets an already-used token error when they later click the link. Stytch's own Email Magic Links product prevents this automatically, but when you send your own emails containing embeddable magic links, detecting and stopping bot traffic is your responsibility.

Verified resolution: If users report magic links that never work on first click, suspect email security scanners, not your auth code. Either send through Stytch's Email Magic Links product (it handles bot traffic for you), or add bot detection in front of your authenticate endpoint: CAPTCHA or device fingerprinting on the landing page before you redeem the token. Never redeem the token on a plain GET with no bot check, and log token redemption attempts so you can tell scanner burns apart from real user failures.

Source URL: https://stytch.com/docs/api-reference/consumer/api/magic-links/embeddable/create