Question 1

Why passwordless

Accepted Answer

Security, higher conversion rates and fewer support tickets are just a few reasons to adopt passwordless authentication.

Up to 54% ${color}[#6851ff](higher conversion rates) with passwordless. Source
59% of people use the ${color}[#6851ff](same password for every site), making a data leak anywhere a security risk everywhere. Source
Password resets can account for up to 50% of ${color}[#6851ff](support tickets), costing you time. Source
1/3 of shopping carts are abandoned due to forgotten passwords. Source
48% of customers never come back after a data breach. Source

Question 2

Can't I build passwordless myself?

Accepted Answer

Magic can help speed up your development time, because as a developer, you can focus on building your application, not authentication.
Researching and integrating your own Social Logins, Webauthn, and security features like Request Anomaly Detection can take months (with Magic, it can take minutes).
Peace of mind knowing Magic has failover in case an email provider has delays
Small misconfigurations will lead to your emails being blocked or sent to spam folders
Offload your security to experts. No need to invest in penetration tests or hire security experts.
Processing requests at scale is expensive.
Save money by leveraging Magic's competitive pricing.

Question 3

How do I start using Magic

Accepted Answer

To get started, sign up for a developer account in our dashboard.
Then check out some of our guides
And here you can review the docs.

If you have any questions along the way, please reach out!

Question 4

Can I remove Magic's branding?

Accepted Answer

Magic gives developers full control over the UI and branding.

Hide Magic's "check your email" modal

To hide the default modal when a user triggers the email, just pass in showUI: false when initiating the magic login, like const did = await magic.auth.loginWithMagicLink({ email, showUI: false });. You can then show your own modal telling the user to click the email link sent to them.

Customize the Magic Link Email

In the Magic Dashboard, choose your app and select Branding. From there you can add your brand's logo, which will display in the email, as well as add your brand colors.

| Note: At this time, it's not possible to remove "Secured by Magic" from the Confirmation Page or Pending Page.

Question 5

How are sessions handled with Magic

Accepted Answer

There are different ways to handle sessions with Magic. You can either rely on Magic for session management, or rely on your own backend, which can offer more flexibility.

Relying on Magic for session management

When a user logs in, they create a new session that is valid for 7 days. Unless the user explicitly logs out, they won’t have to log in again for 7 days. It's possible to customize session length in the Magic dashboard.

As a developer, call magic.user.isLoggedIn() to check if the user is authenticated with Magic on your application. (link)

Relying on your backend for session management

If you have a backend, you can manage user sessions with either cookies or by relying on the DID token Magic provides.

Cookies

After a user authenticates, they will create two sessions, one with your app (first party), one with Magic (third party). You will rely on your first party session, managed by having your server issue a cookie to each user once they successfully login. The cookie can contain user-specific data allowing you to tell who makes each request. The cookie can also be encrypted before it's set inside the client, and decrypted by your backend on each request so you can read from it. With this setup, Magic only serves as the authentication layer.

See our guide here for managing sessions with cookies and JSON web tokens https://magic.link/posts/magic-jwt

DID Tokens

When a

Question 6

Feature requests

Accepted Answer

Much of our roadmap is driven by developer feedback, so if there's something you'd like to see added, let us know here: https://magic.canny.io

Frequently Read Articles

Browse All Categories