Magic Link
Passwordless sign-in by e-mail with Abrova Auth. The user enters an e-mail, opens the one-time link (15 minutes, single use) and is signed in; the account is created on first use.
The user types an e-mail address and receives a sign-in link. Opening it brings them back to your app with a one-time token, which the SDK trades for a session. No password to remember; the account is created the first time the address signs in.
Set it up in the Console#
- Abrova Auth › Sign-in methods: turn on Magic link.
- Abrova Auth › Settings › Link addresses: add the address the link opens, for example
https://example.com/auth/magicormyapp://auth/magic.
On mobile, make that address open your app: a custom URL scheme, or an Apple universal link / Android App Link for an https:// address.
Send the link#
// Flutter await AbrovaAuth.instance.sendMagicLink(email, redirectUrl: 'myapp://auth/magic');
// iOS try await AbrovaAuth.shared.sendMagicLink(email: email, redirectURL: "myapp://auth/magic")
// Android AbrovaAuth.shared.sendMagicLink(email, redirectUrl = "myapp://auth/magic")
// Web and React Native
await auth.sendMagicLink({ email, redirectUrl: 'https://example.com/auth/magic' });The answer is the same whether or not the address has an account. Tell the user to check their inbox.
Sign in with the link#
The link opens <redirectUrl>?token=.... Read the token and sign in:
// Flutter: token from the incoming link await AbrovaAuth.instance.signInWithMagicLink(Uri.parse(link).queryParameters['token']!);
// iOS: pass the URL the app was opened with try await AbrovaAuth.shared.signInWithMagicLink(url: openedURL)
// Android: from the intent that opened the activity
AbrovaAuth.tokenFromLink(intent.dataString ?: "")?.let { AbrovaAuth.shared.signInWithMagicLink(it) }// Web
const token = new URL(location.href).searchParams.get('token');
if (token) await auth.signInWithMagicLink({ token });The first sign-in with an address creates the user, with the e-mail marked as verified. Later links sign in to the same user.
Rules#
| Rule | Value |
|---|---|
| Link lifetime | 15 minutes |
| Uses | Once. A second open fails with TOKEN_INVALID |
| E-mails per address | A few per hour |
| Link addresses | Only the ones you allowed; anything else fails with INVALID_INPUT |
A magic-link user and an e-mail-and-password user with the same address are the same user: the link proves the address. Users signed in with Apple or Google are separate, even with the same address.
Errors#
| Code | Meaning |
|---|---|
| TOKEN_INVALID | The link is invalid, already used, or older than 15 minutes. Send a new one. |
| INVALID_INPUT | Not a valid e-mail, or the redirectUrl is not one of your link addresses. |
| RATE_LIMITED | Too many links for this address or from this place. Try again after retryAfterSec. |
| USER_DISABLED | You disabled this user in the Console. |
| NOT_CONFIGURED | E-mail delivery is temporarily unavailable. |
| METHOD_DISABLED | Magic link is off for the project. |