Magic link

Magic-link sign-in lets a user log in without a password — they enter their email, Huudis sends them a single-use link, and clicking it signs them in. It's an optional alternative to the password; nothing forces a user to use it.

How it works

1. On the sign-in screen the user picks "Email me a sign-in link" and enters their email.
2. Huudis emails a link to https://huudis.com/magic-link/verify?token=…. The response to the request is always the same whether or not an account exists — Huudis never reveals which emails are registered.
3. The user clicks the link. Huudis verifies the token and signs them in, issuing the standard session.

The link is single-use and expires after 15 minutes. Requesting a new link invalidates the previous one.

Who it works for

Magic link signs in existing, verified, enabled users only. It does not create an account — sign-up still happens through the normal email/password or social flow. A link requested for an unknown or unverified address simply does nothing (and the response looks identical, to avoid leaking which emails exist).

With MFA

If the user has MFA enrolled, the magic link gets them past the first factor and then drops them into the same MFA challenge as a password login — they still complete their second factor before a session is issued. Magic link is a convenience for the first factor, not a way around MFA.

Endpoints

Method	Path	Purpose
POST	/api/v1/auth/magic-link/request	Body { email }. Always returns 200 { ok: true }.
POST	/api/v1/auth/magic-link/verify	Body { token }. Returns a session, or { mfaRequired: true, … } if the user has MFA.