Magic links and email codes

Turn on Magic link under Users → Sign in / Providers. Each request sends one email that contains a sign-in link and a 6-digit code, so people can sign in on the device that has the email, or type the code on another device.

#Send the email

await sovaria.auth.sendMagicLink('ada@example.com', { redirectTo: 'https://app.example.com/welcome' })

#Sign in with the link

The link opens your redirect URL with ?token=…&type=magiclink:

const result = await sovaria.auth.handleEmailLink()
if (result?.type === 'magiclink') goTo('/dashboard')   // the user is signed in

#Sign in with the code

await sovaria.auth.verifyEmailCode('ada@example.com', '482913')

#Rules

• Link and code expire after 15 minutes and work once; using one invalidates the other.
• A code allows 5 wrong attempts, then a new email must be requested.
• Requests are rate-limited per email and per IP.
• Completing a magic link or code also confirms the user's email address.
• If the user has MFA turned on, they still have to complete it.