API ReferenceAuth

Send a magic link

Sends a single-use, short-lived sign-in link. ALWAYS returns the same generic 200 whether or not the address has an account — the response is the enumeration channel, so it carries no signal. Sign-up via magic link is off unless AUTH_MAGIC_LINK_ALLOW_SIGNUP is set.

POST
/{appUid}/auth/magic-link/request

Path Parameters

appUid*string

Your app's unique id. Find it in the console under the app's Settings, or in the URL of any app page.

Formatuuid

Request Body

application/json

TypeScript Definitions

Use the request body type in TypeScript.

Response Body

application/json

application/json

application/json

application/json

curl -X POST "https://example.com/497f6eca-6276-4993-bfeb-53cbbbba6f08/auth/magic-link/request" \  -H "Content-Type: application/json" \  -d '{    "email": "user@example.com"  }'
{  "message": "If an account exists for that email, a sign-in link will be sent."}

List sign-in methods

Which doors THIS deployment offers (password, magic link, email OTP, and the configured OAuth providers), plus whether each one may create an account. Unauthenticated so a sign-in page can render before anyone signs in. Describes configuration only — never anything about a particular account, which is what would enable enumeration.

Sign in with a magic link

Spends the token from the emailed URL and issues a session. Single use: a second attempt with the same token fails like any other invalid link.