Configure Magic Links

A Magic Link allows a user to authenticate without entering a username or password. When enabled, the user receives an email with a Magic Link that they can use to authenticate. Magic Links are time-limited and single-use.

Before you configure these settings, confirm that outbound email delivery is working for your tenant.

Consider the following when configuring Magic Link settings:

• Magic Links can be configured as an authenticator in an authentication flow for the following (See Configure Magic Link for users):
  • SAML applications
  • OIDC and OAuth applications
  • User Portal
  • Applications using IDaaS Authentication API
• For a user to be able to use a Magic Link for authentication, Magic Link must be enabled as a second-factor authenticator in the resource rule authentication flow. See Create authentication flows.
• Registration must be enabled to send users Magic Link for registration. See Configure user registration.
• Password Reset must be configured to send Magic Links to users for password reset. See Enable password reset.

Configure Magic Links

1. Click > Policies > Authenticators. The Authenticators page appears.

2. Click Magic Link. The Magic Link page appears.

3. Select Registration Magic Link to allow administrator-initiated Magic Links for registration.

4. Select Automatically Email Magic Links to automatically email a registration link to new users.

5. Select Password Reset Magic Link to allow administrator-initiated Magic Links for password reset.

6. Optional: Select Redirect Enabled to redirect a user to an allowed URL after they complete registration or password reset. This feature is disabled by default. If you enable the feature, do the following:

   1. Click Add. The Allowed URL field appears.

   2. Enter the Allowed URL. You can add up to 20 redirect URLs. Wildcards (for example, *) cannot be used, and custom paths or ports are not allowed in redirect URLs. The URL must be an exact match when creating the Magic Link.

      note

      Redirect URLs work only for users of Administration APIs.

7. Enter the Lifetime to set how long the Magic Link is valid before it expires.

8. Select the Default User Email Attribute to automatically send users a Magic Link.

   • If you do not select this option, you can send a Magic Link to individual users. See Configure Magic Links for users.
   • If a user has multiple email addresses, select the one that automatically receives the Magic Link. See Create and manage user attributes to create an alternate email for a user.

9. Click Save.

Validate your changes

After you save, verify the following:

1. The enabled Magic Link types match your intended registration, password reset, and authentication flows.
2. If redirect is enabled, allowed URLs are configured correctly and users are redirected as expected.
3. A test user receives the Magic Link email at the expected email attribute.
4. The link expires according to the configured Lifetime and cannot be reused.

note

If the registration process is cancelled or there is an error using the Magic Link, the redirect URL includes the outcome, for example https://example.com/?outcome=cancel.