Magic link

How Feedjolt magic links sign you in: a one-time, 15-minute email link, no passwords. Covers single-use rules, sessions, multiple devices, and sign-out.

A magic link is a one-time URL we email you that signs you in when clicked. No password to remember, nothing to store.

How it works

Enter your email at /login or /register.
Solve the Cloudflare Turnstile challenge (usually invisible).
Check your inbox for an email from [email protected].
Click the link in the email.
You're signed in.

The link is valid for 15 minutes and is single-use. If you click it twice, only the first click works.

Behind the scenes

The link contains a short-lived JWT.
Clicking exchanges it for a session pair: a 15-minute access token + a 7-day refresh token, both as httpOnly cookies.
The frontend auto-refreshes when the access token expires; you stay signed in.

Multiple devices

Each device has its own session pair. Signing in on your laptop doesn't sign you out on your phone.

Sign out

Dashboard -> Settings -> Profile -> Sign out, or just clear your cookies.

To sign out from all devices: Settings -> Security -> Sign out everywhere. This invalidates every refresh token; you'll need a fresh magic link to come back.

Trouble?

Didn't get the email. Check spam. Add [email protected] to your address book.
Link says "expired". That's the 15-minute window. Request a new one.
Link says "already used". It's single-use. Request a new one.
Browser blocked the redirect. Open the link in a different browser, or copy-paste the URL.

Security notes

We hash links server-side; the link in your email is not stored as-is.
Failed-login attempts are rate-limited per IP.
We never store passwords. There's nothing to reset.

If you suspect someone else has access to your email, Settings -> Security -> Sign out everywhere is your friend.