Magic Link Login in Your Next.js SaaS -- Passwordless Auth With Resend

Most users forget their SaaS password within a week of signing up. Then they click "forgot password," wait for an email, click a link, and create a new one -- two round trips to the login flow before they did anything useful in your product.

Magic links skip the password entirely. The user types their email, clicks a link in their inbox, and they are in -- authenticated, no password created or stored. It is the same pattern Notion used early on, and it works especially well for products where users sign in once a week or less.

This post shows how to add passwordless magic link login to your Next.js SaaS using the JWT and Resend setup that is already in the boilerplate.

How Magic Link Auth Works

The flow has five steps:

1. User types their email on the login page
2. Your server creates a short-lived signed token (JWT, 15 minutes) and emails a link like https://yourapp.com/auth/verify?token=...
3. User clicks the link
4. Your server verifies the token, looks up or creates the user, and issues a session JWT
5. User is logged in

Three properties make this secure: tokens expire after 15 minutes, each token can only be used once, and the user has to access their actual email inbox to complete the login. There are no passwords to store or hash -- which removes a whole class of security risk.

When to Use Magic Links vs Passwords

Magic links are not always better than passwords. Here is the decision framework:

Use magic links when:

• Users sign in infrequently -- once a week or once a month
• Your users are business professionals with reliable email access
• You want the simplest possible auth for a B2B SaaS MVP
• You want to avoid password storage entirely on a new product

Stick with passwords when:

• Users sign in multiple times a day
• You expect users to work offline or in low-connectivity environments
• Speed at the login screen matters more than inbox friction

Many SaaS products offer both. A magic link option sits alongside the password form as a "sign in with email" button -- useful for users who forgot their password and for products that want to minimize sign-in friction on first use. The Next.js SaaS Boilerplate already ships with password auth, so magic links become an additional path rather than a replacement.

What You Actually Need to Build

Here is the full picture of what the feature requires -- and how much of it you already have.

One new database table: magic_tokens with a hashed token, the email it was issued for, an expiry timestamp, and a used flag. You store the SHA-256 hash of the token, not the raw value.

Two new API routes:

POST /api/auth/magic-link/request

• Validate the email with Zod
• Generate a random token, hash it, store in magic_tokens with a 15-minute expiry
• Send the raw token in an email link via Resend
• Return 200 whether the email exists or not (this prevents attackers from learning which emails are registered)

GET /api/auth/magic-link/verify?token=...

• Hash the incoming token, look up the hash
• Check expiry and used flag -- reject if either fails
• Mark the token as used immediately
• Look up or create the user by email
• Issue a session JWT, redirect to the app

One email template: A clean "Sign in to [Your App]" email with a single button. The link expires in 15 minutes so the copy should say that clearly so users do not save the link for later.

The password reset flow uses the same short-lived JWT-in-email pattern. Magic link auth is that same flow -- just without the "create a new password" step at the end. If you have already built password reset, magic links take a few hours, not a day.

Combining With Social Login

If you have added Google and GitHub sign-in, you can offer all three auth methods -- password, magic link, and OAuth -- from the same login page. The session JWT is identical regardless of how the user authenticated, so your middleware and getUserFromRequest() calls do not change.

This covers every user preference without requiring you to maintain a separate auth service or pay for Auth0.

What the Boilerplate Already Handles

On the Next.js SaaS Boilerplate, you already have:

• lib/auth.ts -- JWT signing, verification, and getUserFromRequest()
• lib/email.ts -- emailService.sendEmail() wired to Resend
• modules/user/ -- the user lookup and creation pattern
• Drizzle ORM + Neon DB -- add magic_tokens in one schema file and run a migration

You are writing two API routes and one email template. Everything else is already there.

Ship Passwordless Auth This Week

Magic link login is one of the most user-friendly improvements you can make to a SaaS MVP. It removes the password memory problem, eliminates a storage risk, and takes an afternoon to build when your JWT and email infrastructure is already in place.

Get the boilerplate and add passwordless auth to your SaaS today: boilerplate.iteam-company.com