Magic link

A magic link is a one-time URL we email you that signs you in when clicked. No password to remember, nothing to store.

How it works

1. Enter your email at /login or /register.
2. Solve the Cloudflare Turnstile challenge (usually invisible).
3. Check your inbox for an email from [email protected].
4. Click the link in the email.
5. You're signed in.

The link is valid for 15 minutes and is single-use. If you click it twice, only the first click works.

Behind the scenes

• The link contains a short-lived JWT.
• Clicking exchanges it for a session pair: a 15-minute access token + a 7-day refresh token, both as httpOnly cookies.
• The frontend auto-refreshes when the access token expires; you stay signed in.

Multiple devices

Each device has its own session pair. Signing in on your laptop doesn't sign you out on your phone.

Sign out

Dashboard -> Settings -> Profile -> Sign out, or just clear your cookies.

To sign out from all devices: Settings -> Security -> Sign out everywhere. This invalidates every refresh token; you'll need a fresh magic link to come back.

Trouble?

• Didn't get the email. Check spam. Add [email protected] to your address book.
• Link says "expired". That's the 15-minute window. Request a new one.
• Link says "already used". It's single-use. Request a new one.
• Browser blocked the redirect. Open the link in a different browser, or copy-paste the URL.

Security notes

• We hash links server-side; the link in your email is not stored as-is.
• Failed-login attempts are rate-limited per IP.
• We never store passwords. There's nothing to reset.

If you suspect someone else has access to your email, Settings -> Security -> Sign out everywhere is your friend.