ramon / magic-link

v1.0.3 2026-11-04 01:50 UTC

Requires

• php: ^8.3
• flarum/core: ^2.0.0

Requires (Dev)

• flarum/phpstan: ^2.0
• flarum/testing: ^2.0
• fof/recaptcha: ^2.0
• phpstan/phpstan: ^2.1
• phpunit/phpunit: ^11.5 || ^12.5.22 || ^13.2.0
• roave/security-advisories: dev-latest

Suggests

• flarum/gdpr: Account erasure without asking for a password that the member does not have.
• fof/recaptcha: Asks for the reCAPTCHA before sending a sign in or sign up code.

MIT

• Ramon Guilherme

• login
• Passwordless
• flarum
• magic-link
• one-time-code

Published on Packagist.org on 2026-11-04 01:50 UTC

README

Magic Link

Passwordless sign in and sign up for Flarum 2. No password, nothing to leak.

Members type their email (or username) and get a 6-digit code and a sign in link by email. Typing the code or clicking the link signs them in. Signing up works the same way: username and email, a code to confirm the address, and the account is created already confirmed.

Password login can stay on as an option, with "Email me a one-time login code" right under the email field. Everything uses Flarum's own log in and sign up modals, so the default theme, Avocado and Canela keep their look.

What it does

• Every form without a password: log in, sign up, change email, forgot password, the admin's create and edit user, and account erasure with flarum/gdpr
• One box per digit for the code, with paste and one-time-code autofill on phones, a resend countdown and "use a different email address"
• With passwords off, the server refuses passwords everywhere, never stores one and turns password reset off; old hashes go away as members sign in, or all at once with php flarum magic-link:purge-passwords
• Only the latest email works; the code is single use, and using the code or the link burns the other
• The link opens a page with a button showing which account it is for, so email scanners that open it first don't sign anyone in
• The same answer for emails with and without an account, limits per IP and per email that count requests rather than accounts, and a honeypot for bots
• An account that was never confirmed loses whatever its creator left behind (password, sessions, social logins) when the real owner confirms it by code
• Sign up still finishes through Flarum's registration, so fields added by other extensions (terms, profile) and social sign in (fof/oauth) keep working
• Works with fof/recaptcha: asking for a sign in or sign up code needs the reCAPTCHA, following its sign in and sign up options (checkbox, invisible and v3)

Installation

composer require ramon/magic-link
php flarum migrate
php flarum cache:clear

Enable Magic Link on the Extensions page and make sure your forum can send email (Admin → Email). Passwords stop working right away; switch Allow log in with password on in the settings to keep them alongside the email code. Expired codes are deleted by the daily magic-link:prune command, so run php flarum schedule:run from cron every minute.

Good to know

• If email delivery breaks, nobody can sign in. Anyone with server access can print a one-time sign in link with php flarum magic-link:login-url <username>; it also works in maintenance mode.
• With the default sync queue the email is sent during the request. A real queue (Redis, database) keeps response times the same for every address.
• Behind a reverse proxy or CDN, make sure PHP sees the visitor's IP (for example nginx real_ip), otherwise everyone shares the per-IP limit.
• Codes and links are stored only as SHA-256 hashes.

Languages

Brazilian Portuguese and English ship with the extension. Core strings come from the Flarum language packs.

Credits

Magic Link is maintained by Ramon Guilherme.

License

MIT. Ideas and bug reports are welcome on the issue tracker.