Step 01
Step 1
Type your email; we mail a magic link that expires in fifteen minutes.
Auth & IDRetail
Email magic link.
Sign in by clicking a single-use link mailed to your inbox.
The problem
Why this exists.
Some users do not want SMS in the loop — bad coverage, a roaming SIM, or a spam-flagged operator number.
We want a second sign-in path that does not depend on the cellular network or on a password.
How it works · 3 steps
From input to outcome.
- Step 02
Step 2
Click the link in your inbox; the same browser tab finishes the sign-in.
- Step 03
Step 3
On a fresh device, we ask for a confirming OTP as a second factor.
Under the hood
The models and routes behind it.
Models called
No models cite this feature directly — backing logic is deterministic Python.
API routes
- POST /api/v1/auth/email
Compliance posture
- DPDP §6 — email is collected with stated purpose; not used for marketing without separate consent.
- Link is single-use, signed, and time-bound; replay returns an honest 'this link is spent' page.
- Same-device check prevents the click-on-phone-finish-on-desktop hijack pattern.
What it's not
Magic links are sign-in, not identity verification. The link is single-use and we never share it with third parties.
Related · features & stories