Magic Link

Passwordless sign-in — users click a link in their email, no password needed.

Supabase

How it works

The user enters their email on /signin. The request hits /api/auth/magic-link, which generates a secure one-time token via the Supabase Admin API and sends a branded email via Resend. Clicking the link calls /api/auth/verify, which exchanges the token for a live session.

Without RESEND_API_KEY, the route falls back to Supabase's built-in email delivery — useful for local testing before setting up Resend.

Step 1 — Create a Resend account

Sign up at resend.com.
Add your sending domain under Domains → Add and follow the DNS steps.
Create an API key under API Keys → Create API Key.
Add it to .env.local:

RESEND_API_KEY=re_xxxxxxxxxxxxxxxx

Step 2 — Set the sender address

// src/config.ts
mail: {
  fromAdmin: "Your App <hello@yourdomain.com>",
  supportEmail: "support@yourdomain.com",
  replyTo: "support@yourdomain.com",
},

WarningThe domain in fromAdmin must be verified in Resend, otherwise emails will fail to send.

Step 3 — Add Supabase admin credentials

The magic link route uses the Supabase Admin API to generate tokens server-side:

NEXT_PUBLIC_SUPABASE_URL=https://xxxx.supabase.co
SUPABASE_SERVICE_ROLE_KEY=eyJ...

Customize the email template

Edit src/emails/MagicLinkEmail.tsx to change the button copy, colors, and footer text. The template is plain React/JSX so you have full control.