Magic Link Authentication.

A passwordless sign-in flow where the user receives a single-use URL by email or SMS that, when clicked, authenticates the session. It belongs to the Identity & Access category of cybersecurity.

A passwordless sign-in flow where the user receives a single-use URL by email or SMS that, when clicked, authenticates the session.

Magic link authentication replaces the password step with a one-time, expiring URL delivered to a channel the user already controls — usually their primary email or a verified phone number. The link encodes a short-lived signed token (often a JWT or opaque nonce) that the application validates and exchanges for a session. Slack, Notion, Substack, Vercel, and many SaaS products use magic links as their default flow because they remove password reuse and storage problems. NIST SP 800-63B classifies it as an out-of-band authenticator (AAL2) when the channel is sufficiently independent. Risks include phishing of the link, email account takeover, and aitm relays; mitigations include short TTLs, device binding, single-use tokens, and combining the link with a passkey or device trust check.

Defences for Magic Link Authentication typically combine technical controls and operational practices, as detailed in the full definition above.

Common alternative names include: Email magic link, One-time link login, Passwordless link.