Send passwordless magic link — sendmagiclink
const url = 'https://example.com/api/auth/send-magic-link';const options = { method: 'POST', headers: {'Content-Type': 'application/json'}, body: '{"email":"hello@example.com","callback_origin":"https://example.com","callback_next":"example","attribution":"example"}'};
try { const response = await fetch(url, options); const data = await response.json(); console.log(data);} catch (error) { console.error(error);}curl --request POST \ --url https://example.com/api/auth/send-magic-link \ --header 'Content-Type: application/json' \ --data '{ "email": "hello@example.com", "callback_origin": "https://example.com", "callback_next": "example", "attribution": "example" }'Admin generateLink (magiclink) + Mailgun. IP rate limited. Callback URL from body callback_origin,
X-AppHandoff-Callback-Origin, Origin, or Referer (allowlisted). Optional callback_next
preserves a safe in-portal destination after the email link completes. Optional attribution
(the raw ah_attr cookie value) rides the callback URL as attr so signup attribution survives
a link opened in another browser; an invalid or oversized value is ignored, never a 400.
Request Body required
Section titled “Request Body required ”object
Responses
Section titled “ Responses ”Magic link sent
object
Invalid request
object
Human-readable error message
Stable machine-readable error code for client branching
First validation message per field path
object
Structured validation issues (Zod)
object
Seconds until rate limit resets (429 responses)
Rate limited
object
Human-readable error message
Stable machine-readable error code for client branching
First validation message per field path
object
Structured validation issues (Zod)
object
Seconds until rate limit resets (429 responses)
Seconds until the rate limit resets