← All practicals

Sign in with a magic link

Email yourself a one-click sign-in link — single-use, 15 minutes, and never auto-clicked.

1. 1

   On the sign-in page, request an email sign-in link for your OWN account.

   A magic link is only ever a LOGIN method for an account that already exists — the request looks identical whether or not the email is real, so nobody can probe which addresses have accounts here.

2. 2

   Open the email and look at the link BEFORE clicking the button.

   The database stores only the SHA-256 hash of the token in that link — never the raw value — the exact discipline every other single-use credential in the Lab follows (OAuth codes, device codes, PAR requests).

3. 3

   Land on the confirmation page, then press "Complete sign-in".

   A plain page load never signs you in — only the button’s POST does. Email clients and security scanners prefetch links with GET; if that silently consumed a single-use token, the real click would find it already burned.

4. 4

   Copy the same link into a second tab and try it again.

   The consume is single-use, atomically flipped in the database — a concurrent or later replay of the identical token is refused, the same protection an OAuth authorization code gets.