TL;DR

Magic links on mobile need deep links and redirect URLs. A 6-digit code needs neither.

In Supabase it's the same feature: put {{ .Token }} in the Magic Link email template and users get a code.

signInWithOtp({ email }) sends it, verifyOtp({ email, token, type: 'email' }) signs in.

The built-in email service only sends to your project's team. Set up custom SMTP before real users.

Codes are 6 digits, expire after 1 hour by default, and can be requested once per 60 seconds.

1. Template

Dashboard → Authentication → Email Templates → Magic Link:

<p> Your sign-in code: <strong> {{ .Token }} </strong></p>

Enter fullscreen mode

Exit fullscreen mode

2. Send

await supabase . auth . signInWithOtp ({ email : email . trim (). toLowerCase (), options : { shouldCreateUser : true }, // false = existing users only });

Enter fullscreen mode

Exit fullscreen mode

3. Verify

const { data , error } = await supabase . auth . verifyOtp ({ email : email . trim ().…