Question 1

Can't I build passwordless myself

Accepted Answer

Magic can help speed up your development time, because as a developer, you can focus on building your application, not authentication.
Researching and integrating your own Social Logins, Webauthn, and security features like Request Anomaly Detection can take months (with Magic, it can take minutes).
Peace of mind knowing Magic has failover in case an email provider has delays
Small misconfigurations will lead to your emails being blocked or sent to spam folders
Offload your security to experts. No need to invest in penetration tests or hire security experts.
Processing requests at scale is expensive.
Save money by leveraging Magic's competitive pricing.

Question 2

How do I start using Magic

Accepted Answer

To get started, sign up for a developer account in our dashboard.
Then check out some of our guides
And here you can review the docs.

If you have any questions along the way, please reach out!

Question 3

Can I remove Magic's branding

Accepted Answer

Magic gives developers full control over the UI and branding.

Hide Magic's "check your email" modal

To hide the default modal when a user triggers the email, just pass in showUI: false when initiating the magic login, like const did = await magic.auth.loginWithMagicLink({ email, showUI: false });. You can then show your own modal telling the user to click the email link sent to them.

Customize the Magic Link Email

In the Magic Dashboard, choose your app and select Branding. From there you can add your brand's logo, which will display in the email, as well as add your brand colors.

Question 4

How are sessions handled with Magic

Accepted Answer

There are different ways to handle sessions with Magic. You can either rely on Magic for session management, or rely on your own backend, which can offer more flexibility.

Relying on Magic for session management

When a user logs in, they create a new session that is valid for 7 days. Unless the user explicitly logs out, they won’t have to log in again for 7 days. This is not yet customizable by developers, but will be soon.

As a developer, call magic.user.isLoggedIn() to check if the user is authenticated with Magic on your application. (link)

Relying on your backend for session management

If you have a backend, you can manage user sessions with either cookies or by relying on the DID token Magic provides.

Cookies

After a user authenticates, they will create two sessions, one with your app (first party), one with Magic (third party). You will rely on your first party session, managed by having your server issue a cookie to each user once they successfully login. The cookie can contain user-specific data allowing you to tell who makes each request. The cookie can also be encrypted before it's set inside the client, and decrypted by your backend on each request so you can read from it. With this setup, Magic only serves as the authentication layer.

See our guide here for managing sessions with cookies and JSON web tokens https://magic.link/posts/magic-jwt

DID Tokens

When a us

Question 5

Feature requests

Accepted Answer

Much of our roadmap is driven by developer feedback, so message us on what features or integrations you'd like us to support!

Question 6

Magic Security

Accepted Answer

Security Features

Magic is SOC-2 compliant
Request Anomaly Detection to block fraudulent login attempts
24/7 Network Traffic Monitoring
End-to-end TLS Data Encryption
Zero Knowledge Proofs to prove a user is authenticated without users needing to reveal any sensitive information

Frequently Read Articles

Browse All Categories