SuperTokens is an open source authentication solution offering features like: Different types of login: Email / password, Passwordless (OTP or Magic link based).

SuperTokens.com

Hello guys ! Small questions regarding the passwordless flow. When a user do multiple login attempts and so received multiples login links in his email account, he can still click on the first  generated link. Why the first link is not invalide ?

We only revoke passwordless links if any one of them is successfully consumed or has expired.

@Hey <@498057949541826571> Thanks for the reply. Ok but if the user has requested 2 links within the same hour and he did not click on any oh those links, he can still click on the oldest one ?

is there a way to invalide the old one even if he did not clicked on any link ?

and yes you can invalidate the older one by overriding the create code function on the backend to fetch all the codes for the input email and revoke them.

<@435107855880683521> can help with code snippet if you tell us which backend SDK is being used.

Thanks for the answer <@498057949541826571>  we are using the python passwordless sdk

you can check here for information about overriding functions: https://supertokens.com/docs/emailpassword/advanced-customizations/backend-functions-override/usage

I'll come up with a code snippet shortly 🙂

So you'd need something like this:
```py
from supertokens_python import init, InputAppInfo
from supertokens_python.recipe import passwordless
from supertokens_python.recipe.passwordless.interfaces import CreateCodeOkResult
from supertokens_python.recipe.passwordless.interfaces import RecipeInterface
from typing import Union, Dict, Any

def override_passwordless_functions(original_implementation: RecipeInterface):
    original_create_code = original_implementation.create_code
    async def create_code(
            email: Union[None, str],
            phone_number: Union[None, str],
            user_input_code: Union[None, str],
            user_context: Dict[str, Any],
        ) -> CreateCodeOkResult:
        await original_implementation.revoke_all_codes(email, phone_number, user_context)
        return await original_create_code(email, phone_number, user_input_code, user_context)
    
    original_implementation.create_code = create_code
    return original_implementation

init(
    app_info=InputAppInfo(api_domain="...", app_name="...", website_domain="..."),
    
    framework='...', 
    recipe_list=[
        passwordless.init(
            contact_config=..., 
            flow_type="...", 
            override=passwordless.InputOverrideConfig(
                functions=override_passwordless_functions
            )
        )
    ]
)
```

this will call `revoke_all_codes` when the user is starting a new login attempt.

Btw, you can also control how long the magic links are valid if that's the basis of this issue.