v4

latestOpenAPI 3.1.1Apache 2.02026-07-31107278570.4 KB

Magic link & OTP

Send passwordless email

Send a verification email containing either a verification code (OTP), magic link, or both to a user's email address

post/api/v1/passwordless/email/send

Request body

emailstring

Email address where the passwordless authentication credentials will be sent. Must be a valid email format.

expires_ininteger

Time in seconds until the passwordless authentication expires. If not specified, defaults to 300 seconds (5 minutes)

magiclink_auth_uristring

Your application's callback URL where users will be redirected after clicking the magic link in their email. The link token will be appended as a query parameter as link_token

statestring

Custom state parameter that will be returned unchanged in the verification response. Use this to maintain application state between the authentication request and callback, such as the intended destination after login

template'SIGNIN' | 'SIGNUP'

template_variablesobject

A set of key-value pairs to personalize the email template.

You may include up to 30 key-value pairs.
The following variable names are reserved by the system and cannot be supplied: otp, expiry_time_relative, link, expire_time, expiry_time.
Every variable referenced in your email template must be included as a key-value pair.

Use these variables to insert custom information, such as a team name, URL or the user's employee ID. All variables are interpolated before the email is sent, regardless of the email provider.

Example request

{
  "email": "john.doe@example.com",
  "expires_in": 300,
  "magiclink_auth_uri": "https://yourapp.com/auth/passwordless/callback",
  "state": "d62ivasry29lso",
  "template_variables": {
    "custom_variable_key": "custom_variable_value"
  }
}

Response

Successfully sent passwordless authentication email. Returns the authentication request details including expiration time and auth request ID

auth_request_idstring

Unique identifier for this passwordless authentication request. Use this ID to resend emails.

expires_atstring int64

Unix timestamp (seconds since epoch) when the passwordless authentication will expire. After this time, the OTP or magic link will no longer be valid.

expires_ininteger

Number of seconds from now until the passwordless authentication expires. This is a convenience field calculated from the expires_at timestamp.

passwordless_type'OTP' | 'LINK' | 'LINK_OTP'

Example response

{
  "auth_request_id": "h5Y8kT5RVwaea5WEgW4n-6C-aO_-fuTUW7Vb9-Rh3AcY9qxZqQ",
  "expires_in": 300
}