Magic Link Login: How to Add Sign In by Email
Magic link login lets people sign in with a one-time link sent by email. Here’s how it works, what to tell Claude Code, and the security basics to get right.
Quick answer
Magic link login lets people sign in by clicking a one-time link emailed to them, with no password to remember. To add it, ask Claude Code to switch on magic links in your login setup and send the email through your transactional email service. Keep each link single-use, short-lived and built from your own web address.
Last checked: October 2026
On this page
Magic link login lets people sign in to your SaaS by clicking a link in their email instead of typing a password. They enter their email address, your SaaS sends them a one-time link, and one click later they're in.
This guide covers how magic links work, where they fit, what to tell Claude Code, a sample email, and the security basics to get right.
A magic link email is a transactional email: an automatic message your product sends because someone did something. It sits alongside account emails like password reset emails and email verification for new sign-ups.
What is magic link login?
Magic link login is a way to sign in without a password. Your SaaS emails the person a link that contains a token, a long random code that proves the link came from you and belongs to that account. Clicking the link signs them in.
Two rules make it safe. Each link works once, and it stops working after a short time. Supabase Auth, a popular login service, expires magic links after one hour by default and lets each person request a new link once every 60 seconds.
You'll also see it called a "passwordless login email." Some products send a short code to type in instead, or both.
What are the pros and cons of magic links?
Magic links remove passwords and the support work that comes with them, but sign-in depends on reaching an inbox.
| Magic links | Passwords | |
|---|---|---|
| Signing in | Enter email, click the link | Enter email and password |
| Forgotten details | Nothing to forget | Needs a reset email |
| Weak or reused passwords | Not possible | A common risk |
| Speed | Waits for an email to arrive | Instant |
| Switching devices | Open the email where you want to sign in, or use a code | Works anywhere |
Good fits: tools people sign in to now and then, SaaS products with simple accounts, and early products where fewer sign-up steps matter.
Weaker fits: products people sign in to many times a day, and anything holding money or sensitive personal data. NIST, the US standards body, rules out email as a second sign-in check, partly because an inbox can be opened with a password alone. For sensitive accounts, add a second step or offer passkeys (sign-in with a fingerprint, face or device PIN).
How does the magic link flow work?
- The person enters their email address on your sign-in page.
- Your SaaS creates a one-time token, saves it against that account, and sets an expiry time.
- Your SaaS emails a link containing the token through your email service.
- The page says "Check your email," whether or not the address has an account, so nobody can use the form to find out who your users are.
- The person clicks the link, and your SaaS checks that the token is real, unused and in date.
- If it is, the token is marked as used and the person is signed in. If not, they see a clear message and a button to send a new link.
You rarely need this built from scratch. Login services such as Supabase Auth and Auth.js have magic links built in. Claude Code switches the feature on and connects it to your email.
One catch: login services usually send the email themselves. Supabase's built-in sender is meant for testing; it delivers to your project's team members alone and is currently capped at two emails an hour. For real users, the email needs to go through a transactional email service, and Claude Code can make that change.
What should you tell Claude Code to add magic link login?
Connect your email service first, then describe the sign-in you want in plain sentences. If SimpleSends isn't connected yet:
- Sign up on the SimpleSends website and follow the steps there to set up the email address you'll send from. To send from your own domain, this includes adding a few DNS records (the settings that tell the internet how your domain handles email) where your domain is registered. Our guide to choosing a sending domain helps you pick the address.
- In Claude Code, open Customize, then Connectors, choose Add, then Add custom connector. A connector is an MCP server, which lets Claude Code work with an outside service while you build.
| Field | What to enter |
|---|---|
| Name | SimpleSends |
| MCP server URL | https://mcp.simplesends.com/mcp |
- When Claude prompts you to connect, log in to SimpleSends.
- Back in the chat, tell Claude Code: "I've connected SimpleSends for all transactional email." It takes it from there, including adding what your project needs to send email.
Then brief it on magic links:
I'd like people to sign in to my SaaS with a magic link instead of a password. They enter their email, get a link that works once and expires after 15 minutes, and land on their dashboard when they click it. Use the login setup the project already has if it supports magic links, and send the email through SimpleSends. Show me the sign-in page and a preview of the email before you build the rest.
What to expect: Claude Code explains how this fits your current login setup, shows you the page and email, and asks what it needs to know, such as whether new people can sign up this way.
Some workplace email systems, such as Microsoft's Safe Links, open every link to scan it. That can use up a one-time link before the person clicks it, so plan for it:
Some company email systems open links to scan them, which can use up a one-time link before the person clicks. Make sure that can't break sign-in. Add a six-digit code to the email as a backup, or have the link open a page with a "Sign in" button that completes the sign-in.
Then test it before anyone else sees it:
Send a test magic link to hello@yourcompany.com. Then try using the same link twice, and try a link after it has expired, and tell me what happens each time.
What to expect: the test arrives in your inbox, Claude Code checks the SimpleSends send log to confirm it went out, and it walks you through each result. For a fuller pre-launch check, see how to test your emails before your users see them.
Here's the kind of email to aim for:
SubjectYour sign-in link for YourCompany
Hi,
Click the button below to sign in to YourCompany. This link works once and expires in 15 minutes.
Or enter this code on the sign-in page: 482 913
If you didn't ask to sign in, you can ignore this email. Nobody can get into your account without this link or code.
YourCompany · hello@yourcompany.com
Keep it short, with one button and no promotions. Supabase's guidance for sign-in emails says the same: few links and no marketing content.
What are the security basics for magic links?
A magic link is a key to someone's account. These basics come from OWASP's guidance on emailed tokens and from login service docs:
| Basic | What it means |
|---|---|
| Random, long tokens | Each token is made by a secure random generator and is too long to guess. |
| Single use | A token stops working the moment it's used. |
| Short expiry | 15 minutes to an hour is typical. Supabase defaults to one hour; Auth.js defaults to 24 hours, so ask Claude Code to shorten it. |
| Stored safely | Tokens are saved in a protected form, never in plain text. |
| Same message for everyone | The sign-in page responds the same way whether or not an account exists. |
| Request limits | People can't request links again and again, which protects inboxes and your sending reputation. |
| Your own web address | Links are built from your SaaS's fixed web address, never from details in the incoming request, and always use https. |
| No link tracking | If your email service rewrites links to count clicks, switch that off for sign-in emails, because rewritten links can stop working. |
To check what Claude Code built, send one more message:
Please review our magic link sign-in against these basics: random tokens, single use, a 15-minute expiry, safe storage, the same message for every address, limits on how often links can be requested, links built from our own web address over https, and no click tracking. Tell me what's missing and fix it.
If a user says their link never came, see how to check whether your emails actually sent.
For the other emails your SaaS sends, see 12 transactional emails every SaaS needs.
Frequently asked questions
Can I offer magic links and passwords at the same time?
Yes. Many SaaS products show a “Sign in with email link” option next to the usual password form. Tell Claude Code you want both, and which one should appear first. Keep the two flows consistent, so the same email address always reaches the same account whichever way someone signs in.
Do magic links work for new sign-ups too?
They can. Some login services create an account automatically the first time someone requests a link. Supabase Auth does this by default unless it’s switched off. Decide whether you want that, and tell Claude Code. If you’d rather keep sign-up separate, ask it to send links only to existing accounts.
What’s the difference between a magic link and a one-time code?
A magic link signs someone in with one click. A one-time code is a short number, often six digits, that they type into your sign-in page. Codes are handy when someone reads email on their phone but wants to sign in on a laptop. Many products include both in the same email.
What should I do if a user says their sign-in email never arrived?
Ask Claude Code to check. With SimpleSends connected, it can read the send log and delivery status, tell you whether the email went out and to which address, and help work out why it didn’t arrive. Common causes are a typo in the address or a request blocked by your limits.
Do I need my own domain to send magic link emails?
It’s strongly recommended. Sign-in emails sent from your own domain, such as hello@yourcompany.com, look trustworthy and match the site people are signing in to. You set this up once when you sign up for an email service, by adding a few settings where your domain is registered.
Sources (7)
- Passwordless email sign-in(checked October 5, 2026)
- Email Templates(checked October 5, 2026)
- Send emails with custom SMTP(checked October 5, 2026)
- Send Email Hook(checked October 5, 2026)
- Email Providers (Magic Links), Auth.js(checked October 5, 2026)
- Forgot Password Cheat Sheet, OWASP(checked October 5, 2026)
- NIST Special Publication 800-63B-4, Digital Identity Guidelines: Authentication(checked October 5, 2026)
Keep reading
More on Task guides →New User Signup Notification: Get Emailed on Each Sign-Up
Set up a new user signup notification so your SaaS emails you each time someone signs up. What to tell Claude Code, what to include, and when to switch.
5 min read
Trial Ending Email: How to Send Trial and Renewal Reminders
When to send a trial ending email, what to say, and how to have Claude Code build trial and renewal reminders for your SaaS, with sample emails to adapt.
6 min read
Order Confirmation Email: Send Receipts Automatically
What an order confirmation email should include, how to send it automatically after payment, and how to brief Claude Code to build it for your SaaS.
6 min read