Hi There! I am interested in magic links. I am wondering if what I am trying to do is possible. 1. I invite a User to visit a page in my app by sending them a magic link (Note, docs for this are missing: https://supertokens.com/docs/passwordless/common-customizations/generating-magic-link-manually) 2. The URL will be of the form https://myapp.com/[magic] 3. The page is available to anybody with the magic link (in theory only the person who receives my invitation) 4. The link needs to expire after 24 hours or maybe 48 hours 5. The page/route with the magic link is visible, but NO OTHER page/route should be visible (i.e. it is not the same as authenticating to the app) 6. The regular passwordless (using email) should continue to grant general access to the app, so only the magic link is a bit different What do you think about this approach? Does my explanation make sense? Can I do this with SuperTokens, or do I need to roll my own guard for this special route? Or, is there a better way to show only one page / route in my app using a magic link only with SuperTokens? Thanks! =David

hey @dleangen

Hey @rp_st thanks! Regarding point #5... Let's say my app has 2 "regular" routes, and 1 "magic" route: Route a: /regular-route-a/maybe/has/sub-routes/too Route b: /regular-route-b/maybe/has/sub-routes/too These make up the “regular” pages in my app, which of course require authentication. There is also a “magic” route, which is not authenticated. It is “secured” in that only the person who knows the magic link can access it: Magic route: /[magic secret]/maybe/has/sub-routes/too So “authenticating” and “knowing the magic link” are really two different things. Does that make sense?

Ah right. So in that case, you should still guard those magic routes with the session guard - just like the regular routes. But in the session that is created for the magic link user, you can add something in their access token payload like "isMagicLinkUser: true" and check on the frontend that this boolean exists in the payload and only if it does, should you show the magic routes.

Ok, I'll give that a try. Thanks!!

So that’s the api which the frontend calls

Perhaps it would be safer to use this?

>      body: {
>        linkCode: 'tYySg...',
>        preAuthSessionId: 'AVFnk...'
>      },

wdyt?

Oh yea. Sure. Can do

It looks like I need to send along some additional data when I execute

createCode()

, but I am having trouble seeing how to do that. I tried using the

userContext

, but my data gets overwritten, so I don't see it on the server. Any ideas?

you could use the preAPIHook function to add custom info to the request body

Ok, thanks. I am having a bit of trouble understanding preAPIHook from the docs. Is there an example somewhere I could see?

Which frontend SDK are you using?

react

Which recipe?

This is for the magic links, so I guess passwordless?

Oh, thanks! For some reason neither Google nor the search function on the site showed me that one. Cheers!

Hmmm. Weird

Probably just a bad search query. I was using "preAPIHook".

oh i see. So for web-js, the preAPIHook is part of the function call - there is an options input which contains that

Right, that's what I thought, but I asked if you should show me an example, so I was trying to understand from the link you gave. 🤣

i can send an example shortly.

Awesome, thanks!! 😀

I think this may work:

Passwordless.createCode({
    email: "...",
    options: {
        preAPIHook: async (context) => {
            let requestInit = context.requestInit;
            let bodyStr = requestInit.body?.toString();
            if (bodyStr !== undefined) {
                let body = JSON.parse(bodyStr);
                body = {
                    ...body,
                    "customKey": "customValue"
                }
                bodyStr = JSON.parse(body);
            } 
            context.requestInit.body = bodyStr
            return context;
        }
    }
})

This was VERY helpful. Thanks! Strange question, perhaps, but what is the "secret" or "magic" part of the magic link? The query part of the URL is something like:

?rid=passwordless&preAuthSessionId=xZri2I9tmjtyibDxoEsobH3ZVKfALRMuH29gO0dvlqU=#tXCnql1-v3QoSliniHhU2kbQTbMuz0k7LKFijzGzDwQ=

I suppose the sessionID is just the session ID, but would it be the anchor part of the URL after the "#" that is the secret (so in the example above, the part starting with "tXC")?

yup

Cool, thanks!