---
title: "Authenticate a user by sending them a magic link."
method: POST
path: "/magiclink"
tags: ["auth"]
---

# Authenticate a user by sending them a magic link.

`POST /magiclink`

A magic link is a special type of URL that includes a One-Time Password. When a user visits this link in a browser they are immediately authenticated.

## Request body

- object
  - `email` string, email, required
  - `data` object
  - `gotrue_meta_security` GoTrueSecurity — Use this property to pass a CAPTCHA token only if you have enabled CAPTCHA protection.
    - `captcha_token` string

## Response `200`

A recovery email has been sent to the address. An empty JSON object is returned. To obfuscate whether such an email address already exists in the system this response is sent regardless whether the address exists or not.

- object

## Other responses

- `400` — HTTP Bad Request response. Can occur if the passed in JSON cannot be unmarshalled properly or when CAPTCHA verification was not successful. In certain cases can also occur when features are disabled on the server (e.g. sign ups). It may also mean that the operation failed due to some constraint not being met (such a user already exists for example).
- `422` — Returned when unable to validate the email address.
- `429` — HTTP Too Many Requests response, when a rate limiter has been breached.

---

[API](https://skmtc.net/supabase/apis/supabase-auth-rest-api.md) · [All operations](https://skmtc.net/supabase/apis/supabase-auth-rest-api/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/supabase/supabase-auth-rest-api/versions/2664b89bee49/schema)