| Method · Route | Purpose |
|---|
POST /magic-link/send | Email a login link |
POST /magic-link/verify | Verify the token → session (a web origin gets an HttpOnly cookie; SDK callers keep the token from the response body) |
| Method · Route | Purpose |
|---|
POST /magic-link/send | Email a sign-in link (valid 10 minutes, single use). No authentication. |
POST /magic-link/verify | { "token" } → the end-user JWT (accessToken). No authentication. |
Verifying the link activates a pending (imported or invited) user. The link is only built on a registered address — see redirectUrl below.
Limits on send: one link per email address per minute (400), and for addresses that are not yet users of the app group, 5 per 10 minutes and 20 per day per IP and 120 per 10 minutes per app group (429 MAGIC_LINK_THROTTLED). 400 is also returned when magic link is not enabled for the app group.
| Field | Meaning |
|---|
email | Where the link is sent. |
redirectUrl | Where the link lands — the hosted portal’s /login/(applicationKey)/verify route. Must be the portal itself or one of the app’s Callback URLs. |
postSignInRedirectUrl | Where the user goes after the link signs them in (the page they came from). Validated against the app’s Callback URLs (exact match or same origin) and carried inside the link as redirect_url, so the round-trip works from any device or browser profile. Unregistered values are dropped, never rewritten. |
turnstileToken | Cloudflare Turnstile token when bot protection is on. |