Magic Link

Intent: Allow a user to authenticate or reset a password by clicking a one-time link delivered out-of-band (usually by email).

Context:
A service needs to confirm a user’s identity without passwords or long-term credentials.
Common cases include password resets, passwordless login, and account verification.

Solution:
Generate a short-lived, single-use URL that embeds a cryptographically random token tied to a specific user and purpose.
When the user clicks the link, the server validates and consumes the token, granting limited authority (e.g. “log in once,” “set new password”).
The URL is the capability.

Consequences:
✔️ Simple user experience — no password to remember
✔️ Scoped and revocable authority
⚠️ Bearer semantics — must protect against link leakage and reuse

Related patterns: Bearer Token, Pre-Signed URL, CareTaker

Citations:

• Password reset workflow — Django Documentation (2013, ongoing).
• Secure authentication in Next.js with magic links — Clerk Blog (2023-06).
• NextAuth.js Email Provider — Auth.js Docs (2024-02).
• Flask-Security-Too Features — Project Documentation (2023-10).