Passwordless Magic Link Login

[roshankumar0036singh]

Problem Statement

Users suffer from password fatigue, leading to forgotten passwords and friction during the login process.

Technical Approach

Create new /api/auth/magic-link/request and /api/auth/magic-link/verify endpoints. Store a highly secure, short-lived (e.g., 15m) token in Redis and email it as a clickable link.

Acceptance Criteria

• Users can authenticate purely via email.
• Magic links are single-use and expire after 15 minutes.
• Rate limiting is strictly enforced on the request endpoint.

[arcgod-design]

Hi @roshankumar0036singh! I'd love to work on this as part of SSoC '26.

My Approach:

• Create /api/auth/magic-link/request endpoint that generates a short-lived (15m) signed token, stores it in Redis, and emails the magic link to the user
• Create /api/auth/magic-link/verify endpoint that validates the token from Redis, marks it as used (single-use), and issues a JWT session
• Enforce rate limiting on the request endpoint using a sliding window counter (e.g., max 5 requests/hour per email)
• Invalidate the token immediately after first use to prevent replay attacks

Could you please assign this to me (@arcgod-design)? Thank you!