Magic link
An email-delivered link that signs the user in without requiring a password.
A magic link is an authentication mechanism where the user enters their email address, receives a one-time-use link via email, and clicks it to sign in — bypassing passwords entirely. The link typically expires within 15–30 minutes and can be used only once.
Magic links improve UX (no password to forget) and security (no password to phish or breach) when implemented correctly. The trade-off is dependency on email delivery: if your authentication-email infrastructure goes down, your users can't log in. Most production systems implement magic links as a complement to passwords or OAuth, not as the sole method.
For the email program, magic-link infrastructure should run on a separate transactional ESP and ideally a separate subdomain from marketing email. Marketing-side deliverability problems shouldn't cascade to break authentication. The links themselves should be cryptographically signed, single-use, and short-lived.