Passwordless Authentication
Email OTP authentication in Account UI
Account UI supports passwordless authentication via email OTP.
Email OTP
When VITE_ENABLE_EMAIL_OTP=true (default: false):
- Users enter their email address
- A one-time password is sent via email
- User enters the OTP code to authenticate
The sign-in email contains the six-digit code only — no magic-link companion. Mail-client URL prefetching burns single-use links, so a code the user types is the reliable path.
What about magic links?
Account UI's sign-in screen does not request magic links — its passwordless flow is OTP. When the magicLink Better Auth plugin is enabled (see Auth Plugins) and your own UI requests a link, the emailed link opens Account UI's /magic-link page. Only the Continue signing in button there spends the single-use token, so a mail scanner that fetches the link can't burn it.
Related
- Auth Plugins — Plugin configuration
- Environment Variables