Email a one-click sign-in link
Sends a single-use, short-lived sign-in link. ALWAYS returns the same generic 200 whether or not the address has an account — the response is the enumeration channel, so it carries no signal. Sign-up via magic link is off unless AUTH_MAGIC_LINK_ALLOW_SIGNUP is set.
Path Parameters
Your app's unique id. Find it in the console under the app's Settings, or in the URL of any app page.
uuidRequest Body
application/json
TypeScript Definitions
Use the request body type in TypeScript.
Response Body
application/json
application/json
application/json
application/json
curl -X POST "https://example.com/497f6eca-6276-4993-bfeb-53cbbbba6f08/auth/magic-link/request" \ -H "Content-Type: application/json" \ -d '{ "email": "user@example.com" }'{ "message": "If an account exists for that email, a sign-in link will be sent."}Email a 6-digit sign-in code
Returns an opaque `requestId` — the half the client keeps — and emails the code. An address with no account still gets a requestId (a decoy that resolves to no row), so the response shape never differs. The code is stored only as a salted digest and is attempt-capped.
Request password reset
Requests a magic-link password reset email. Always returns a generic success response.