gusmanwidodo/auth-kit-magic-link

Magic-link (passwordless) plugin for Auth-Kit. Adds /auth-kit/magic-link/* endpoints, a single-use token store, and expiry enforcement via the core hook pipeline.

v0.1.1 2026-08-25 15:26 UTC

Requires

• php: ^8.3
• gusmanwidodo/auth-kit: ^0.1
• illuminate/contracts: ^12.0
• illuminate/support: ^12.0

Requires (Dev)

• orchestra/testbench: ^10.0
• pestphp/pest: ^3.0
• pestphp/pest-plugin-laravel: ^3.0

MIT

• Gusman Widodo

• Authentication
• login
• laravel
• Passwordless
• magic-link
• auth-kit

Published on Packagist.org on 2026-08-25 15:28 UTC

README

Magic-link (passwordless) plugin for Auth-Kit. A standalone Composer package that plugs into the Auth-Kit core to add passwordless login: request a single-use, time-limited link and consume it to authenticate — with expiry enforced via the core hook pipeline.

What it demonstrates

Like auth-kit-otp, this package uses the full plugin surface as an independent package that only depends on the core:

• HasSchema — ships the auth_kit_magic_link_tokens migration
• HasRoutes — adds POST /auth-kit/magic-link/request and GET /auth-kit/magic-link/consume
• HasHooks — a before:magic-link.consume hook that rejects expired links

Requirements

• PHP ^8.3
• gusmanwidodo/auth-kit ^0.1
• Laravel 12

Installation

composer require gusmanwidodo/auth-kit-magic-link

Both the core and this plugin are auto-discovered. Run migrations to create the token table:

php artisan migrate

Optionally publish the config:

php artisan vendor:publish --tag=auth-kit-magic-link-config

Endpoints

Method	URI	Body / Query	Purpose
POST	/auth-kit/magic-link/request	{ identifier }	Issue + store a hashed single-use token, return a login URL
GET	/auth-kit/magic-link/consume	?identifier=&token=	Validate + burn the link, running the hook pipeline

In production, deliver the link via mail/SMS. The login_url is only returned in the request response while running tests.

Flow

1. POST /auth-kit/magic-link/request with { "identifier": "[e-mail]" } → stores a hashed token, returns login_url (in tests) valid for ttl seconds.
2. User clicks the link → GET /auth-kit/magic-link/consume?identifier=...&token=... → the core before:magic-link.consume hook rejects expired links, the token hash is checked, and on success the link is burned (single use) and the configured redirect is returned.

Config

config/auth-kit-magic-link.php:

'ttl'      => 900, // seconds a link stays valid (15 min)
'redirect' => '/', // where to send the user after success

Developing against a local core

When both repos are checked out side by side, point Composer at the local core before installing:

composer config repositories.auth-kit path ../auth-kit
composer require gusmanwidodo/auth-kit:@dev
composer install
composer test

License

MIT © Gusman Widodo. See LICENSE.