Passwordless (magic links)

Sign in via email-only magic links. No passwords to forget, no resets, no leaks.

Magic-link authentication: the user enters their email, gets a sign-in link, clicks it, they’re signed in. No passwords on either side. Common in modern SaaS for its simplicity.

How to enable

Switch to magic-link-only authentication. Remove the password field
from sign-up. On sign-in, just collect an email and send the link.

vly:

1. Removes the password field from sign-up.
2. Wires up the magic-link flow using built-in auth.
3. Sets up the email template (default: simple branded message with the link).

You can keep email + password as an option alongside magic links — same prompt without “remove the password field.”

How it works

1. User enters email

   On the sign-in page.

2. vly sends a one-time link

   Token expires in 15 minutes. Email goes via your configured provider (Resend by default).

3. User clicks the link

   Opens your app, authenticates, signs them in.

4. Session created

   Same long-lived session as password auth.

Tradeoffs

✅ No passwords to forget

Eliminates the password-reset support burden.

✅ No leaked credentials

A leaked database can’t expose passwords that don’t exist.

✅ Smoother sign-up

Lower friction — one field instead of two; no password requirements to remember.

❌ Requires email access

Users without a working email can’t sign in.

❌ Slightly slower

Round-trip via email; ~5–30 seconds to receive.

❌ Email security matters

Compromised email = compromised account. Same as password reset, but every sign-in.

Customizing the email

The default template is short and branded. To customize:

Customize the magic link email. Use the company's brand color (#6D28D9) on
the button. Add the company logo at the top. Update the subject to "Sign in
to YourApp".

For full template control, edit the magicLink template under Workspace settings → Auth → Email templates.

Related

Built-in auth

The full auth system.

OAuth providers

Google / GitHub / etc. as alternatives.

Resend integration

The default email sender.