What is Magic Link?

A magic linkis a one-time login URL emailed to a user that signs them in the moment they click it — no password required. It’s the most common form of passwordless authentication, used by apps like Slack, Notion, and Medium.

How magic links work

When a user enters their email, the app generates a single-use token, stores it (or signs it), and emails a link containing it — something like https://app.example.com/auth?token=abc123. Clicking the link hits that endpoint, the app verifies the token, and a session is created. The token is short-lived and burns on first use, so an old link in an inbox won’t log anyone in.

Magic links vs. OTP, and how to test them

A magic link and an OTP solve the same problem — proving the user controls the inbox — but a magic link is a clickable URL while an OTP is a code the user types. Both are transactional emails worth covering in automated tests. The hard part for testing is pulling the URL out of the email; a disposable inbox that extracts the primary link for you turns that into a one-line assertion. See testing magic-link login.