Passwordless Authentication with Magic Links

You can configure a Passwordless connection to send a Magic Link to a user through email to complete authentication.

To learn more, read Configure Email or SMS for Passwordless Authentication.

When a user opens a Magic Link, Auth0 logs them in directly. It is similar in function to them receiving an email with a one-time password (OTP), returning to your application, and entering the OTP, but without having to actually perform those steps.

Magic Links are not supported for Universal Login.

When using Magic Links with Classic Login, both the initial request and its response must take place in the same browser or the transaction will fail. This is particularly relevant for iOS users, who cannot change their default web browser.

For example, the user might make the initial request using the Chrome browser, but when the user opens the Magic Link in their email, iOS automatically opens it in Safari (the default browser). If this happens, the transaction will fail.

The user then clicks the button or link in the email and is automatically signed in to your application.

1. In the Auth0 Dashboard, go to Authentication > Passwordless, and then enable the Email toggle.

   

2. Select Email to open the configuration window, switch to the Settings view, and enter your email's From, Subject, and Message text.

   
   You must change the From value to an email address that does not use the auth0.com domain for Auth0 to send your custom email templates. If you do not, Auth0 sends the default email template.

3. Enter any Authentication Parameters you would like to include in the generated sign-in link.

4. Decide if you want to Disable Sign Ups. If you enable this setting, you can allow passwordless access for only existing users, but may expose your application to the threat of user enumeration attacks. To learn more, read Passwordless Connections Best Practices.

5. Select Save.

The Message area supports multiple languages.

To specify a language, call the Auth0 Authentication API Get Code or Link endpoint and set the value of the x-request-language header. When this header is not set, the language is extracted from the accept-language header, which is automatically set by the browser.

The Message area accepts Liquid syntax. You can use this syntax, combined with parameter values, to programmatically construct elements of the message.

For example, you can reference the request_language parameter to change the language of the message:

{% if request_language contains 'dutch' %}
   Hier is uw verificatie code: {{ code }}
{% endif %}
{% if request_language contains 'fr-FR' %}
   Ceci est votre code: {{ code }}
{% endif %}

The following parameters are available when defining the message template:

If you are using Classic Login for your application, you must update the page template to implement Magic Links.

1. In the Auth0 Dashboard, go to Branding > Universal Login > Advanced Options.

2. Switch to the Login view, locate the Default Templates dropdown, and select Lock (passwordless).

   

3. Next, update the Auth0LockPasswordless section of code with a new parameter. Add the passwordlessMethod to your template.

   passwordlessMethod: 'link',

   Was this helpful?

   Yes /No

4. Select Save.

To learn more about embedded login configuration options, read Passwordless Authentication with Embedded Login.

Switch to the Applications view, and enable the applications for which you would like to use Passwordless Email.

Auth0 sends emails from its own SMTP provider by default. Auth0's built-in email provider is designed solely for testing purposes and does not support customization of email templates.

Configure your own SMTP email provider to manage, monitor, and troubleshoot your email communications, and customize email templates.

Auth0 supports the following email providers:

• Mandrill

• Amazon SES

• SendGrid

• SparkPost

• Mailgun

• Custom SMTP external email provider