Magic links & two-factor login
Passwordless sign-in and the emailed-code second factor.
On this page
Magic links (passwordless) #
A magic link signs a user in without a password. tada.sendMagicLink(email) emails a one-shot link pointing at your app's verify page, which calls tada.verifyMagicLink(token) to exchange it for a session.
Two-factor (2FA) login #
When your app has two-factor enabled, a successful password (or magic-link) step returns type: "2fa_required" with a challenge token instead of a session. The user types the emailed 6-digit code to finish:
const r = await tada.login(email, password);
if (r.data?.type === '2fa_required') {
// show a code input, then:
await tada.login2fa(r.data['2fa_token'], code);
}
// tada.resend2fa(token) re-issues the code