<!-- llms.txt: https://workos.com/llms.txt -->

# Magic Auth

Magic Auth is a passwordless authentication method that allows users to sign in or sign up via a unique, six digit one-time-use code sent to their email inbox. To verify the code, [authenticate the user with Magic Auth](https://workos.com/docs/reference/authkit/authentication/magic-auth).

## Create a Magic Auth code

Creates a one-time authentication code that can be sent to the user's email address. The code expires in 10 minutes. To verify the code, [authenticate the user with Magic Auth](https://workos.com/docs/reference/authkit/authentication/magic-auth).

:::code-group

```bash language="curl" title="Request" tab="1"
curl --request POST \
  --url "https://api.workos.com/user_management/magic_auth" \
  --header "Authorization: Bearer sk_example_123456789" \
  --header "Content-Type: application/json" \
  -d @- <<'BODY'
    {
        "email": "marcelina.davis@example.com"
    }
BODY
```

```js language="js" title="Request" tab="1"
import { WorkOS } from '@workos-inc/node';

const workos = new WorkOS('sk_example_123456789');

const magicAuth = await workos.userManagement.createMagicAuth({
  email: 'marcelina@example.com',
});
```

```rb language="ruby" title="Request" tab="1"
require "workos"

WorkOS.configure do |config|
  config.api_key = "sk_example_123456789"
end

WorkOS.client.user_management.create_magic_auth(email: "marcelina.davis@example.com")
```

```py language="python" title="Request" tab="1"
from workos import WorkOSClient

client = WorkOSClient(api_key="sk_example_123456789", client_id="client_123456789")

client.user_management.create_magic_auth(email="marcelina.davis@example.com")
```

```go language="go" title="Request" tab="1"
package main

import (
	"context"

	"github.com/workos/workos-go/v10"
)

func main() {
	client := workos.NewClient("sk_example_123456789")

	_, err := client.UserManagement().CreateMagicAuth(context.Background(), &workos.UserManagementCreateMagicAuthParams{
		Email: "marcelina.davis@example.com",
	})
	if err != nil {
		panic(err)
	}
}
```

```php language="php" title="Request" tab="1"
<?php

use WorkOS\WorkOS;

$workos = new WorkOS(
    apiKey: "sk_example_123456789",
    clientId: "client_123456789",
);

$workos
    ->userManagement()
    ->createMagicAuth(email: "marcelina.davis@example.com");
```

```java language="java" title="Request" tab="1"
import com.workos.WorkOS;
import com.workos.usermanagement.UserManagementApi.CreateMagicAuthOptions;

WorkOS workos = new WorkOS("sk_example_123456789");

CreateMagicAuthOptions options =
    CreateMagicAuthOptions.builder().email("marcelina.davis@example.com").build();

workos.userManagement.createMagicAuth(options);
```

```cs language="dotnet" title="Request" tab="1"
using WorkOS;

var client = new WorkOSClient(new WorkOSOptions {
    ApiKey = "sk_example_123456789",
    ClientId = "client_123456789",
});

await client.UserManagement.CreateMagicAuthAsync(new UserManagementCreateMagicAuthOptions {
    Email = "marcelina.davis@example.com",
});
```

```rust language="rust" title="Request" tab="1"
use workos::Client;
use workos::user_management::CreateMagicAuthParams;

#[tokio::main]
async fn main() -> Result<(), workos::Error> {
    let client = Client::builder()
        .api_key("sk_example_123456789")
        .client_id("client_123456789")
        .build();

    let _result = client
        .user_management()
        .create_magic_auth(
            CreateMagicAuthParams {
                email: "marcelina.davis@example.com".into(),
                ..Default::default()
            }
        )
        .await?;

    Ok(())
}
```

```json language="json" title="Response" tab="2"
{
  "object": "magic_auth",
  "id": "magic_auth_01HWZBQZY2M3AMQW166Q22K88F",
  "user_id": "user_01E4ZCR3C56J083X43JQXF3JK5",
  "email": "marcelina.davis@example.com",
  "expires_at": "2026-01-15T12:00:00.000Z",
  "created_at": "2026-01-15T12:00:00.000Z",
  "updated_at": "2026-01-15T12:00:00.000Z",
  "code": "123456",
  "radar_auth_attempt_id": "radar_auth_attempt_01HXYZ123456789ABCDEFGHIJ"
}
```

:::

## Get Magic Auth code details

Get the details of an existing [Magic Auth](https://workos.com/docs/reference/authkit/magic-auth) code that can be used to send an email to a user for authentication.

:::code-group

```bash language="curl" title="Request" tab="1"
curl "https://api.workos.com/user_management/magic_auth/magic_auth_01HWZBQZY2M3AMQW166Q22K88F" \
  --header "Authorization: Bearer sk_example_123456789"
```

```js language="js" title="Request" tab="1"
import { WorkOS } from '@workos-inc/node';

const workos = new WorkOS('sk_example_123456789');

const magicAuth = await workos.userManagement.getMagicAuth(
  'magic_auth_01E4ZCR3C56J083X43JQXF3JK5',
);
```

```rb language="ruby" title="Request" tab="1"
require "workos"

WorkOS.configure do |config|
  config.api_key = "sk_example_123456789"
end

WorkOS.client.user_management.get_magic_auth(id: "magic_auth_01HWZBQZY2M3AMQW166Q22K88F")
```

```py language="python" title="Request" tab="1"
from workos import WorkOSClient

client = WorkOSClient(api_key="sk_example_123456789", client_id="client_123456789")

client.user_management.get_magic_auth(id_="magic_auth_01HWZBQZY2M3AMQW166Q22K88F")
```

```go language="go" title="Request" tab="1"
package main

import (
	"context"

	"github.com/workos/workos-go/v10"
)

func main() {
	client := workos.NewClient("sk_example_123456789")

	_, err := client.UserManagement().GetMagicAuth(context.Background(), "magic_auth_01HWZBQZY2M3AMQW166Q22K88F")
	if err != nil {
		panic(err)
	}
}
```

```php language="php" title="Request" tab="1"
<?php

use WorkOS\WorkOS;

$workos = new WorkOS(
    apiKey: "sk_example_123456789",
    clientId: "client_123456789",
);

$workos
    ->userManagement()
    ->getMagicAuth(id: "magic_auth_01HWZBQZY2M3AMQW166Q22K88F");
```

```java language="java" title="Request" tab="1"
import com.workos.WorkOS;

WorkOS workos = new WorkOS("sk_example_123456789");

workos.userManagement.getMagicAuth("magic_auth_01HWZBQZY2M3AMQW166Q22K88F");
```

```cs language="dotnet" title="Request" tab="1"
using WorkOS;

var client = new WorkOSClient(new WorkOSOptions {
    ApiKey = "sk_example_123456789",
    ClientId = "client_123456789",
});

await client.UserManagement.GetMagicAuthAsync("magic_auth_01HWZBQZY2M3AMQW166Q22K88F");
```

```rust language="rust" title="Request" tab="1"
use workos::Client;

#[tokio::main]
async fn main() -> Result<(), workos::Error> {
    let client = Client::builder()
        .api_key("sk_example_123456789")
        .client_id("client_123456789")
        .build();

    let _result = client
        .user_management()
        .get_magic_auth("magic_auth_01HWZBQZY2M3AMQW166Q22K88F")
        .await?;

    Ok(())
}
```

```json language="json" title="Response" tab="2"
{
  "object": "magic_auth",
  "id": "magic_auth_01HWZBQZY2M3AMQW166Q22K88F",
  "user_id": "user_01E4ZCR3C56J083X43JQXF3JK5",
  "email": "marcelina.davis@example.com",
  "expires_at": "2026-01-15T12:00:00.000Z",
  "created_at": "2026-01-15T12:00:00.000Z",
  "updated_at": "2026-01-15T12:00:00.000Z",
  "code": "123456"
}
```

:::

### magic_auth

| Field | Type | Required | Description |
| --- | --- | --- | --- |
| `id` | string | Yes | The unique ID of the Magic Auth code. |
| `user_id` | string | Yes | The unique ID of the user. |
| `email` | string | Yes | The email address of the user. |
| `expires_at` | string | Yes | The timestamp when the Magic Auth code expires. |
| `code` | string | Yes | The code used to verify the Magic Auth code. |
| `created_at` | string | Yes | The timestamp when the Magic Auth code was created. |
| `updated_at` | string | Yes | The timestamp when the Magic Auth code was last updated. |

### POST /user_management/magic_auth

| Field | Type | Required | Description |
| --- | --- | --- | --- |
| `email` | string | Yes | The email address to send the magic code to. |
| `invitation_token` | string | No | The token of an [invitation](/reference/authkit/invitation). The invitation should be in the pending state. When a valid invitation token is specified, the user is able to sign up even if it is disabled in the environment. Additionally, if the invitation was for a specific organization, attaching the token to a user's authenticate call automatically provisions their membership to the organization. |
| `ip_address` | string | No | The IP address of the user's request. |
| `user_agent` | string | No | The user agent string from the user's request. |
| `radar_auth_attempt_id` | string | No | The ID of an existing Radar authentication attempt to associate with this request. |
| `signals_id` | string | No | An optional Radar signals ID to correlate client-side signals with this request. |

#### Returns

| Field | Type | Description |
| --- | --- | --- |
| `magic_auth` | object | Distinguishes the Magic Auth object. |

### GET /user_management/magic_auth/{id}

#### Parameters

| Parameter | Type | Required | Description |
| --- | --- | --- | --- |
| `id` | string | Yes | The unique ID of the Magic Auth code. |

#### Returns

| Field | Type | Description |
| --- | --- | --- |
| `magic_auth` | object | Distinguishes the Magic Auth object. |