How-to guides

Passwordless sign-in with magic links

Magic links let users sign in by clicking a link in their email: no password to forget or leak.

Start a projectAll guides
login.ts
const { error } = await supabase.auth.signInWithOtp({
  email,
  options: { emailRedirectTo: window.location.origin },
})

Handle the session

session.ts
supabase.auth.onAuthStateChange((event, session) => {
  if (event === 'SIGNED_IN') showApp(session.user)
})

Phone sign-in

The same flow works for phone numbers: signInWithOtp({ phone }), then verifyOtp with the code the user receives.

Questions

Where does the link redirect?

To the emailRedirectTo URL, which must be in the redirect allow-list.

Updated 2026-10-23.

Start a project