Q: Can't I build passwordless myself?

<ul> <li>As a developer, you should focus on building your ${color}<a href="**application**">#6851ff</a>, not ${color}<a href="**authentication**">#6851ff</a>.</li> <li>Researching and integrating your own ${color}[#6851ff](Social Logins), ${color}<a href="**Webauthn**">#6851ff</a>, and security features like ${color}[#6851ff](Request Anomaly Detection) takes months.</li> <li>Peace of mind knowing Magic has ${color}<a href="**failover**">#6851ff</a> for email providers</li> <li>Small misconfigurations will lead to your emails being blocked or sent to spam folders</li> <li>Offload your security to experts. No need to invest in penetration tests or hire security experts.</li> <li>Processing requests at scale is expensive.</li> <li>${color}[#6851ff](Save money) by leveraging Magic's competitive pricing.</li> </ul>

Question 1

Can't I build passwordless myself?

Accepted Answer

As a developer, you should focus on building your ${color}#6851ff, not ${color}#6851ff.
Researching and integrating your own ${color}[#6851ff](Social Logins), ${color}#6851ff, and security features like ${color}[#6851ff](Request Anomaly Detection) takes months.
Peace of mind knowing Magic has ${color}#6851ff for email providers
Small misconfigurations will lead to your emails being blocked or sent to spam folders
Offload your security to experts. No need to invest in penetration tests or hire security experts.
Processing requests at scale is expensive.
${color}[#6851ff](Save money) by leveraging Magic's competitive pricing.

Question 2

Can I remove Magic's branding?

Accepted Answer

Magic puts full control in the developers hands, from UI to custom branding.

To hide the default modal after a user clicks "sign in", just pass in showUI: false when initiating the magic login, like let did = await magic.auth.loginWithMagicLink({email, showUI: false});. You can then show your own screen instead telling the user to click the email link sent to them.

Question 3

Feature requests, Integration requests, or anything else you'd like us to know?

Accepted Answer

Much of our roadmap is driven by developer feedback, so you can help contribute by letting us know what you'd like to see!

Question 4

How are sessions handled with Magic?

Accepted Answer

There are multiple ways to handle sessions with Magic. Relying on Magic for session management, or Relying on your backend for session management.

Relying on Magic for session management

When a user logs in, they create a new session that is valid for 7 days. Unless the user explicitly logs out, they won’t have to log in again for 7 days. This is not customizable by developers.

As a developer, call isLoggedin() to check if the user is authenticated with Magic on your application. (link)

Relying on your backend for session management

If you have a backend, you can manage user sessions with either cookies or by relying on the DID token Magic provides.

Cookies

After a user authenticates, they will create two sessions, one with your app (first party), one with Magic (third party). You will rely on your first party session, managed by having your server issue a cookie to each user once they successfully login. The cookie can contain user-specific data allowing you to tell who makes each request. The cookie should be encrypted before it's set inside the client, and decrypted by your backend on each request so you can read from it. With this setup, Magic only serves as the authentication layer.

DID Tokens

When a user logs into your app, call getIdToken(lifespan: 9999) and pass in the lifespan argument to get a unique DID token. The lifespan parameter will set the expiration date

Question 5

How do I start using Magic?

Accepted Answer

To get started, sign up for a developer account in our dashboard.
Then check out some of our examples:

And here you can review the docs.

If you have any questions along the way, please reach out!

Question 6

Magic Security

Accepted Answer

Security Features

Magic is SOC-2 compliant
Request Anomaly Detection to block fraudulent login attempts
24/7 Network Traffic Monitoring
End-to-end TLS Data Encryption
Zero Knowledge Proofs to prove a user is authenticated without users needing to reveal any sensitive information

Frequently Read Articles

Browse All Categories