Sign a user in passwordlessly with WorkOS Magic Auth by emailing a one-time code and authenticating that code for a session

Documented steps

1. Enable Magic Auth for the environment in the WorkOS Dashboard under Authentication before calling the API.
2. Send the code: POST https://api.workos.com/user_management/magic_auth with header 'Authorization: Bearer sk_...' and body param email (required). Optional: invitation_token to bind the sign-in to a pending organization invitation.
3. The response returns a magic_auth object containing the generated code and expires_at. WorkOS emails the code to the user automatically; the template is customizable in the Dashboard.
4. To inspect a previously created code, call GET https://api.workos.com/user_management/magic_auth/{id} with the same Bearer secret key.
5. Collect the code from the user, then authenticate: POST https://api.workos.com/user_management/authenticate with client_id, client_secret, grant_type='urn:workos:oauth:grant-type:magic-auth:code', email, and code.
6. On success the response returns user, access_token, refresh_token, and authentication_method='MagicAuth'.
7. Establish a session from those tokens the same way as the hosted flow — seal them into an httpOnly cookie with a 32-character cookiePassword.
8. On a wrong or expired code the authenticate call returns an authentication error instead of tokens — prompt the user to request a fresh code rather than retrying the same one.
9. Reference: https://workos.com/docs/authkit/magic-auth
10. Reference: https://workos.com/docs/reference/authkit/magic-auth