Set up magic-link sign-in

Turn on passwordless magic-link sign-in in Access & Security, learn how the emailed link works, and what email delivery it needs on Cloud and on a self-hosted instance (SMTP, Amazon SES, or Resend).

JM
James Morton
Written By James MortonLast updated 1 day ago

Magic link lets people sign in without a password: they enter their email, click the link Quackback sends them, and they're in. This article covers how magic link works, how to turn it on for customers and your team, and what it needs to send email.

Note: Magic link is off by default until you turn it on.

How it works

  1. The person enters their email on the sign-in page.
  2. Quackback emails them a one-click sign-in link, valid for 10 minutes.
  3. They click the link and are signed in.

The same kind of link is used for team invitations and for recovery-code sign-in, so those flows keep working even when magic link is turned off on the sign-in form.

Turn it on

  1. Go to Admin > Settings > Access & Security and open the Sign-in tab.
  2. In the Email card, turn on Email magic link.

The toggle applies to both the portal sign-in form and the team sign-in form. Who can actually get into a private portal is still decided by the Portal access tab.

Note: The toggle only controls whether magic link appears on the sign-in form. Team invitations, portal invites, and recovery-code sign-in always send a link, whatever the toggle says.

Email delivery

Magic link needs a way to send email.

  • Quackback Cloud: email delivery is handled for you. There's nothing to set up.
  • Self-hosted: configure exactly one email provider (SMTP, Amazon SES, or Resend) with the EMAIL_* environment variables. Until one is configured, the magic-link toggle stays locked off, and links are only written to the server log, which is useful in development only. See Configure email delivery.

Warning: Don't require SSO or rely on magic link in production until email delivery works. If links can't be sent, the people who depend on them can't sign in.

Sign-in hardening

Magic-link requests are rate-limited per IP address and email address. Quackback also emails the account owner when an account signs in from a new device.

Was this helpful?

Your feedback shapes what we write next.

ā† Previous

How sign-in works

Next ā†’

Set up OAuth providers

Related articles

Configure team securitySecure how your team signs in: choose sign-in methods, require two-factor authentication, reset a member's 2FA, use recovery codes, and review and export the audit log.Set up single sign-onConnect an OIDC identity provider such as Okta or Entra ID, copy the correct redirect URI, test sign-in, verify domains, require SSO, generate recovery codes, and map roles from claims.Control portal access and sign-inMake your portal public or private, allow anonymous interaction, admit people by email domain, invite or segment, carry widget sign-in over to the portal, and choose sign-in methods including a custom OIDC button.How sign-in worksUnderstand who can get into your portal and how customers and teammates sign in: portal access channels, sign-in methods, team security, sessions, and why widget sign-in never grants admin access.