Skip to main content

Email Magic Link for Laravel

Passwordless email authentication for Laravel — magic links and one-time codes — that works standalone or alongside Laravel Fortify.

Plenty of packages send a magic link. This one is built around two properties most of them get wrong.

A correct, no-bypass Fortify two-factor handoff​

If a user has two-factor authentication enabled through Fortify, clicking a magic link does not log them in. Instead they are handed off to Fortify's own two-factor challenge in a not-yet-authenticated state, and the login only completes inside Fortify after the code is verified. There is no path that signs a two-factor user in without the second factor — and an end-to-end test runs the real Fortify challenge to keep it that way across Fortify upgrades.

See The two-factor handoff.

The emailed link is a GET that only renders a confirmation page — it performs no authentication and no state change. The single-use token is consumed solely by an explicit POST from that page. Corporate email security scanners (Microsoft SafeLinks, Mimecast, Proofpoint) and browser prefetch follow the GET and cannot burn the link before the human clicks "Sign in".

See Why a magic link costs one extra click.

Install it​

composer require pushery/email-magic-link-for-laravel
php artisan email-magic-link:install
php artisan migrate

That registers a complete browser flow under the web middleware group. Point your "log in" link at route('email-magic-link.request.form') and you have passwordless login.

The full walkthrough — including the queue worker the emails need — is in Installation; Quick start explains what you get out of the box.

Where to go next​

  • Installation — requirements, composer require, the installer, the migration, the publish tags, and the queue worker.
  • Quick start — the routes the package registers, the flow a user walks through, and why it costs one extra click.
  • Configuration — the config file end to end: the three Fortify setups, token lifetimes, the invalid-link response, rate limits, and the user interface.
  • Features — minting links yourself, multi-use links, passphrase gates, one-time codes, the two-factor handoff, the resend guard, multiple guards, the JSON contract, translations, and the WireKit screens.
  • Invitations — the other half of the story: putting an account into service for somebody who does not have one yet, where a magic link can only sign in somebody who does.
  • Guides — authorizing a gated resource without login, the extension points, and keeping the token table small.
  • Reference — every config key, route, command, event, and contract.
  • Security model — the threats the package is designed against and the decision that addresses each one.

Requirements​

PHP ^8.4, Laravel ^13.0, and optionally Laravel Fortify for the two-factor handoff; the full table is on the installation page.

Browser support​

The styled screens render with WireKit and follow its browser floor (Chrome and Edge 111, Safari 16.4, Firefox 128 — the Tailwind v4 baseline). The plain Blade screens use system colors and color-mix() and degrade to the browser's own defaults where those are missing; they promise no floor of their own.

Versioning and license​

The package follows Semantic Versioning. It is in its 0.x line while the public API settles; the backward-compatibility promise begins at 1.0.0.

Released under the MIT License. The source lives at github.com/pushery/email-magic-link-for-laravel; it is built and maintained by PUSHERY.