Magic Link

Overview

Magic Link provides a passwordless sign-in experience. Users enter their email, receive a link, and click it to authenticate — no password needed.

Benefits

No password required — one-click authentication
Auto sign-up — new users are created automatically
Secure — links expire in 5 minutes and are one-time use
Uses existing infrastructure — same Nodemailer + Gmail SMTP setup

How It Works

User enters email

On the sign-in page, the user provides their email address.

Server generates a magic link

Better Auth creates a secure token (32 characters), stores it in the verification collection, and triggers the email callback.

Email is sent

In production, a styled email with the magic link is sent. In development, the link is logged to the console.

User clicks the link

The link hits /api/auth/magic-link/verify?token=..., Better Auth validates the token, creates a session, and redirects to the dashboard.

Server Configuration

The magic link plugin is configured in lib/better-auth/auth.ts:

import { magicLink } from "better-auth/plugins";
import { sendMagicLinkEmail } from "@/lib/nodemailer";

magicLink({
  expiresIn: 60 * 5, // 5 minutes
  disableSignUp: false,
  async sendMagicLink({ email, url, token }, request) {
    if (process.env.NODE_ENV !== "development") {
      await sendMagicLinkEmail({ email, magicLinkUrl: url });
    }
  },
})

Client Usage

import { authClient } from "@/lib/auth-client";

await authClient.signIn.magicLink({
  email: "user@example.com",
  callbackURL: "/dashboard",
  newUserCallbackURL: "/welcome",    // optional
  errorCallbackURL: "/error",        // optional
});

Testing

Development
Production

Run npm run dev
Go to the sign-in page and enter an email
Check the terminal for the magic link URL:

🔐 MAGIC LINK (Development Mode)
To: test@example.com
Magic Link URL: http://localhost:3000/api/auth/magic-link/verify?token=abc123...

Copy the URL and paste it in your browser

Deploy to Vercel (auto-deploys on push to main)
Enter your email on the sign-in page
Check your inbox for the magic link email
Click the link — you should be redirected to the dashboard

Customization

Change expiry time

magicLink({
  expiresIn: 60 * 10, // 10 minutes instead of 5
})

Store tokens as hashed

magicLink({
  storeToken: "hashed", // extra security
})

Security

5-minute expiry — links become invalid quickly
One-time use — each link can only be used once
Cryptographic tokens — 32-character secure random strings
HTTPS only in production
Auto-verified — users are marked as emailVerified: true

Getting Started

Authentication

Deployment

Overview

Benefits

How It Works

Server Configuration

Client Usage

Testing

Customization

Security

​Overview

​Benefits

​How It Works

​Server Configuration

​Client Usage

​Testing

​Customization

​Security

Overview

Benefits

How It Works

Server Configuration

Client Usage

Testing

Customization

Security