Magic link

Let users sign in via a one-time link emailed to them, no password needed.

Enable it

• CLI:

  bridge app update --magic-link-enabled true
  

• Control Center (your admin dashboard at app.thebridge.dev): Auth → Login

• MCP (AI-assistant integration): connect your AI assistant to https://api.thebridge.dev/mcp as a remote MCP server (sign in and approve access to your app in the browser when it asks). Its update_auth_methods tool turns magic links on or off (magicLinkEnabled).

What you need

Nothing extra to turn it on. Magic links are delivered by email, so if you haven’t already configured an email/communication provider, do that first with bridge setup communication.

Where the link comes back

The emailed link returns to the page the user requested it from. sendMagicLink sends that page’s URL (location.origin + location.pathname — no query string, no fragment) along with the request, and Bridge emails that URL with the sign-in token appended:

https://app.example.com/auth/magic-link?bridge_magic_link_token=…

Two things follow from that:

• Keep the requesting route reachable — the user is signed out when they click the link, so the route needs a public: true route rule — and render either MagicLink or LoginForm on it. Both read bridge_magic_link_token on mount, exchange it for a session and strip it from the URL; there’s nothing else to wire up.
• The destination has to be one of your app’s allowed origins. That link carries a token that signs the user in, so Bridge refuses to email it to an address your app doesn’t own. See Allowed origins in the config reference.

Pass successUrl to send the user somewhere other than the page they asked from:

'use client';
import { getBridgeAuth } from '@nebulr-group/bridge-nextjs/client';

async function requestLink(email: string) {
  await getBridgeAuth().sendMagicLink(email, {
    successUrl: 'https://app.example.com/auth/finish',
  });
}

That page needs to redeem the token too, so it should also render MagicLink or LoginForm.

UI components

A ready-made request form handles this. See Magic link in UI components.