Login with magic link flow
A passwordless login flowchart: email input, signed token issue, magic-link email, click-through verification, and session creation. Includes rate-limit and replay protection.
Flowchart previewLogin with magic link flow
Recreate this in Raltey
Copy this prompt
Paste this into Raltey's AI agent to generate the same diagram, then tweak it on the canvas.
Prompt
Create a flowchart for a passwordless magic-link login. User enters email, rate-limit check (throttle if exceeded), issue a signed single-use token, send the magic-link email. After the user clicks, verify the token; if valid and unused, mark it used, create a session cookie, and redirect to the app. Invalid or already-used tokens show an error.
Context
- - Tokens signed and single-use.
- - Rate-limited per email and per IP.
- - Session cookie set after token verification.
Patterns
- - Single-use tokens prevent replay.
- - Rate limit by both email and IP.
- - Short token TTL (e.g., 10 minutes).
Diagram structure
Nodes and connections
User enters emailstart
Within rate limit?decision
Show throttled messageaction
Issue signed tokenaction
Send magic link emailaction
Wait for clickdelay
Verify tokenaction
Valid + unused?decision
Show erroraction
Mark token usedaction
Create session cookieaction
Redirect to append
Connections
User enters emailWithin rate limit?
Within rate limit?Show throttled messageno
Within rate limit?Issue signed tokenyes
Issue signed tokenSend magic link email
Send magic link emailWait for click
Wait for clickVerify token
Verify tokenValid + unused?
Valid + unused?Show errorno
Valid + unused?Mark token usedyes
Mark token usedCreate session cookie
Create session cookieRedirect to app
Notes from the field
- Hash tokens at rest so a DB leak does not expose live links.
- On unknown-email submissions, return the same success message to prevent enumeration.
- Bind the session to user agent + IP to limit cookie theft.
Frequently asked
How long should magic-link tokens live?
5 to 15 minutes is the common range. Shorter limits the attack window; longer is more forgiving for users.
Is this free?
Raltey's Free plan includes the AI agent, 5 projects, and 10 AI generations per month. No credit card required.
More templates
FlowchartSaaS onboarding email flowFlowchartCustomer support runbook flowFlowchartPayment webhook retry and error flowFlowchartGitHub PR review and merge flowArchitectureThree-tier SaaS architecture on AWSArchitectureMicroservices architecture on KubernetesArchitectureReal-time data pipeline on GCPArchitectureNext.js + Vercel + Postgres SaaS stack
Open this template in Raltey
Edit it on the canvas, ask the AI agent to extend it, then share or export.
Start for free