Passwordless Authentication Cheat Sheet

Magic links, passkeys, and OTP

Last Updated: November 21, 2025

Methods

Method Details
Magic link Short-lived email or SMS link
Passkeys WebAuthn + platform authenticators
OTP Time-based tokens

Commands

send magic link
Create signed token
validate token
Mark session
register passkey
Store credential

Security

Monitor link use, expire tokens quickly, and require second factor for high-value actions.

💡 Pro Tip: Combine magic links/passkeys with risk signals and fallback options.
← Back to Security & Privacy | Browse all categories | View all cheat sheets