January 22, 2026 — Passwords are friction. For onboarding screens, recovery flows, and mobile apps where typing a long string is painful, we wanted a first-class alternative that doesn't compromise on security. Starting today, every SyAuth workspace supports magic-link login.
How it works
- The user enters their email in your app.
- SyAuth emails a short one-time code, valid for 15 minutes.
- The user enters the code — or clicks the button in the email — and is signed in.
No password prompt, no reset flow, no "forgot my password" loop.
Built the way you'd expect
- Enumeration-safe. The request endpoint returns the same response whether the email exists or not, so attackers can't probe for account lists.
- Single-use, short-lived codes. 15 minute TTL, consumed atomically — a replay attempt returns "invalid or expired".
- MFA-aware. If the user has a second factor enrolled, we still require it after the magic-link is consumed. Magic-link is not a shortcut around your security posture.
- Email-verified on success. Possession of the inbox counts as verification, so users skip a second step on first use.
For developers
Two public endpoints — POST /auth/magic-link/request/ and POST /auth/magic-link/consume/ — plus a hosted, branded UI at /{locale}/magic-link you can link to directly. Full integration guide on the developer portal.
Available on all paid and free tiers today.