Magic
Plugin for authenticating by sending an email with a login link.
Important: If you chose to use this plugin, make sure you understand the security implications. Although magic links are considered more secure than passwords, they do not provide the same security as e.g. passkeys.
The link is only valid once, and it will only work for 10 minutes.
Since some email clients automatically follows the links in the emails in order to generate a preview, the login call should not be made directly from the page that is served when clicking the link in the email. Instead, the GET request should show a form to POST the key. For convenience, it is recommended to include some javascript in the GET request so that the form is submitted without any user action.