Magic link login
Org-native (dashboard) — /api/auth
Section titled “Org-native (dashboard) — /api/auth”| Method · Route | Purpose | Source |
|---|---|---|
POST /magic-link/send | Email a login link | AuthEndpoints.cs:34 |
POST /magic-link/verify | Verify the token → session (web origin gets an HttpOnly cookie; SDK keeps the body token via CookieAuthWriter) | :42 |
End-user (your app) — /api/public/apps/{applicationKey}/auth
Section titled “End-user (your app) — /api/public/apps/{applicationKey}/auth”| Method · Route | Source |
|---|---|
POST /magic-link/send | PublicEndpoints.cs:461 |
POST /magic-link/verify | :563 |
The end-user flow auto-activates the user and validates the post-login redirect against the application’s callback allowlist before returning.
send request body
Section titled “send request body”| Field | Meaning |
|---|---|
email | Where the link is sent. |
redirectUrl | Where the link lands — the hosted portal’s /login/(applicationKey)/verify route. Must be the portal itself or one of the app’s Callback URLs. |
postSignInRedirectUrl | Where the user goes after the link signs them in (the page they came from). Validated against the app’s Callback URLs (exact match or same origin) and carried inside the link as redirect_url, so the round-trip works from any device or browser profile. Unregistered values are dropped, never rewritten. |
turnstileToken | Cloudflare Turnstile token when bot protection is on. |