Magic links and codes

Sign users in without a password: a magic link or a one-time code sent by e-mail.

#Magic link

JavaScript

await stitchdb.auth.signInWithOtp({
  email: '[email protected]',
  options: { emailRedirectTo: 'https://example.com/welcome', shouldCreateUser: true },
})

The e-mail contains a link that signs the user in and redirects to emailRedirectTo, which must be allowed in Redirect URLs. With shouldCreateUser: false only existing users get a link.

#One-time code

Put {{ .Token }} in the Magic link e-mail template (see E-mails) and let the user type the code:

JavaScript

const { data, error } = await stitchdb.auth.verifyOtp({ email: '[email protected]', token: '123456', type: 'email' })

Codes have 6 digits by default (up to 10) and expire after one hour; change both in Studio → Authentication → Sign-in methods.

#Limits

Magic links count towards the project's hourly e-mail limit, and requests are rate limited per IP address. See Auth limits.