Software Design

Passwordless Magic Link Authentication Flow

UML Sequence Diagrams · made in Skemio

UML sequence diagram showing user, browser, auth service, database, and email provider exchanging magic link tokens and session cookies.
UML sequence diagram showing user, browser, auth service, database, and email provider exchanging magic link tokens and session cookies.
Open it in SkemioMake your own

What it shows

  • Store cryptographic hashes of tokens, never plain token values in database
  • Enforce strict 10-15 minute expiration limits to minimize replay windows
  • Invalidate tokens immediately after a single verification attempt

The takeaway

Magic links eliminate password credential leaks by swapping static secrets for ephemeral single-use tokens.

More uml sequence diagrams