> For AI agents: [llms.txt](https://docs.trustedauth.com/llms.txt) provides a Markdown index of this documentation.

# Configure Magic Links

A Magic Link allows a user to authenticate without entering a username or password. When enabled, the user receives an email with a Magic Link that they can use to authenticate. Magic Links are time-limited and single-use.

Before you configure these settings, confirm that outbound email delivery is working for your tenant.

Consider the following when configuring Magic Link settings:

- Magic Links can be configured as an authenticator in an authentication flow for the following (See [Configure Magic Link for users](/docs/people-and-access/manage-members/add-users-to-identity-as-a-service/configure-magic-link-for-users.md)):
  - SAML applications
  - OIDC and OAuth applications
  - User Portal
  - Applications using IDaaS Authentication API
- For a user to be able to use a Magic Link for authentication, Magic Link must be enabled as a second-factor authenticator in the resource rule authentication flow. See [Create authentication flows](/docs/authentication-and-security/create-and-manage-resource-rules/create-authentication-flows.md).
- Registration must be enabled to send users Magic Link for registration. See [Configure user registration](/docs/people-and-access/manage-user-policies/configure-user-registration.md).
- Password Reset must be configured to send Magic Links to users for password reset. See [Enable password reset](/docs/authentication-and-security/manage-authenticators/manage-password-reset/enable-password-reset.md).

## Configure Magic Links

1. Click Menu icon **>** **Policies > Authenticators**. The **Authenticators** **page** appears.

2. Click **Magic Link**. The **Magic Link** page appears.

3. Select **Registration Magic Link** to allow administrator-initiated Magic Links for registration.

4. Select **Automatically Email Magic Links** to automatically email a registration link to new users.

5. Select **Password Reset Magic Link** to allow administrator-initiated Magic Links for password reset.

6. Optional: Select **Redirect Enabled** to redirect a user to an allowed URL after they complete registration or password reset. This feature is disabled by default. If you enable the feature, do the following:

   1. Click **Add**. The **Allowed URL** field appears.

   2. Enter the **Allowed URL**. You can add up to 20 redirect URLs. Wildcards (for example, *) cannot be used, and custom paths or ports are not allowed in redirect URLs. The URL must be an exact match when creating the Magic Link.

   note
   Redirect URLs work only for users of Administration APIs.

7. Enter the **Lifetime** to set how long the Magic Link is valid before it expires.

8. Select the **Default User Email Attribute** to automatically send users a Magic Link.

   - If you do not select this option, you can send a Magic Link to individual users. See [Configure Magic Links for users](/docs/people-and-access/manage-members/add-users-to-identity-as-a-service/configure-magic-link-for-users.md).
   - If a user has multiple email addresses, select the one that automatically receives the Magic Link. See [Create and manage user attributes](/docs/people-and-access/manage-members/create-and-manage-user-attributes.md) to create an alternate email for a user.

9. Click **Save**.

### Validate your changes

After you save, verify the following:

1. The enabled Magic Link types match your intended registration, password reset, and authentication flows.
2. If redirect is enabled, allowed URLs are configured correctly and users are redirected as expected.
3. A test user receives the Magic Link email at the expected email attribute.
4. The link expires according to the configured **Lifetime** and cannot be reused.

note

If the registration process is cancelled or there is an error using the Magic Link, the redirect URL includes the outcome, for example `https://example.com/?outcome=cancel`.