> **Building with AI coding agents?** Install the authstack plugin with one command. This equips your agent with accurate Scalekit implementation patterns.
>
> **Recommended**:
> ```bash
> npx @scalekit-inc/cli setup
> ```
>
> Global:
> ```bash
> npm install -g @scalekit-inc/cli
> scalekit setup
> ```
>
> Supports Claude Code, Cursor, GitHub Copilot, Codex + skills for 40+ agents.
> Features: full-stack-auth, agent-auth, mcp-auth, modular-sso, modular-scim.
> [Full setup guide](https://docs.scalekit.com/dev-kit/build-with-ai/)

---

# Enable magic link & OTP based sign in

How to configure magic link & OTP based passwordless authentication for your application
Magic link & OTP authentication allows your users to sign in without entering a password. Users can authenticate using any of the following methods:

- A verification code (OTP) sent by email.
- A magic link sent by email.
- Both a verification code and a magic link sent by email.

This guide shows you how to enable each passwordless login method. You should complete the [quickstart guide](/authenticate/fsa/quickstart/) before following this guide, as it covers building a sign-in page that combines Scalekit's hosted UI.

## Configure magic link & OTP settings

You can modify the magic link & OTP behavior from the Scalekit dashboard without changing your code.

 > Image: Scalekit dashboard Passwordless settings showing method selection, expiry period, and security options for magic links and OTP

### Select magic link & OTP options

1. Navigate to the Authentication tab in your Scalekit dashboard environment.
2. Select one of the following options:

    | Method | Description |
    |--------|-------------|
    | Verification code (OTP) | Users receive a one-time code via email that they must enter to sign in. |
    | Magic link | Users receive a secure link via email that they can click to sign in directly. |
    | Verification code and magic link | Users receive both a verification code and a magic link via email, allowing them to choose their preferred method. |

3. Click Save to apply your changes.

### Enable same browser origin enforcement

This setting improves security by requiring users to complete magic link authentication in the same browser where they initiated the sign-in process. This helps prevent phishing attacks where an attacker could use an intercepted magic link on a different device or browser.

To enable this setting, select the **Enforce same browser origin** checkbox in the **Passwordless** section, and click **Save**.

### Enable new passwordless credentials on resend

This setting improves security by generating a new verification code or magic link each time a user asks to resend one. This invalidates the previously sent credential.

To enable this setting, select the **Enable new passwordless credentials on resend** checkbox in the **Passwordless** section, and click **Save**.

### Customize email templates

You can customize the emails sent to users to match your brand, or you can [bring your own email provider](/guides/passwordless/custom-email-provider/) to handle email sends related to magic link & OTP authentication. Scalekit sends the emails when you use it as your email provider.


---

## More Scalekit documentation

| Resource | What it contains | When to use it |
|----------|-----------------|----------------|
| [/llms.txt](/llms.txt) | Structured index with routing hints per product area | Start here — find which documentation set covers your topic before loading full content |
| [/llms-full.txt](/llms-full.txt) | Complete documentation for all Scalekit products in one file | Use when you need exhaustive context across multiple products or when the topic spans several areas |
| [sitemap-0.xml](https://docs.scalekit.com/sitemap-0.xml) | Full URL list of every documentation page | Use to discover specific page URLs you can fetch for targeted, page-level answers |