Test magic link logins without a real inbox
A magic link signs someone in the moment it is opened. Test it in a private inbox you control, and confirm it cannot be reused or opened by the wrong environment.
Free plan includes 500 emails a month. No credit card.
- 1SenderMatches your brand and a monitored address
- 2SubjectClear about what the email does
- 3LinkOpens the right environment, single use
- 4ExpiryStated, short, and enforced
Why magic link emails are hard to test
A magic link is a credential in email form, so where it lands and how many times it can be used both matter.
A live link, not a code
Unlike a code you type in, a magic link signs someone in the moment it is opened, so it needs to land somewhere only you control.
Link previewing and scanning
Some mail clients and security scanners open links automatically to check them, which can burn a single-use magic link before you ever click it.
Environment mix-ups
A magic link is only useful if it opens the environment that sent it. A staging email pointing at production is invisible until someone clicks it.
How to test a magic link login in four steps
The same flow works in local development, staging, and QA.
- 01
Create a test inbox for login
Add an inbox such as [email protected] for the environment you are testing.
- 02
Request a magic link
Enter the test address in your app's passwordless login form and submit it.
- 03
Watch the link arrive live
The email shows up the moment it is sent, so you can follow it without refreshing.
- 04
Click it once, then try again
Confirm the first click signs you in, then click the same link again and confirm it is rejected.
What to check in every magic link email
Arrival is the easy part. These are the details that break in real products.
Sender and reply-to
Matches your brand and a monitored address, not a default from your mail provider.
Link destination
Opens the environment that actually sent it. A staging link opening production is the classic bug here.
Single use, enforced
Clicking the same link a second time fails, it does not sign in again or extend the session.
Expiry window
Commonly 10 to 30 minutes. Test that an expired link fails with a clear message.
Requesting a new link
A fresh request invalidates the previous link rather than leaving both valid.
Scanner-safe by design
If your link can be consumed by an automated preview, confirm your flow handles that (for example requiring a confirmation click before signing in).
Common magic link bugs
If you see one of these, the flow is not ready to ship.
| Bug | What you will notice |
|---|---|
| Link opens production | A staging magic link signs you into the live site. |
| Reusable link | Clicking an already-used link signs you in again. |
| Burned by a scanner | The link is already invalid the first time you click it yourself. |
| No expiry enforced | A link from days ago still signs you in. |
| Session mismatch | The link signs in a different account than the one that requested it. |
| Broken mobile layout | The button is not tappable or the link text overflows on a phone. |
Test magic link logins with Inceptmail
A private test inbox for every project, built for checking exactly what your app sent and how many times a link can be used.
Private and permanent
A real address that only you control, exactly what a magic link needs to be safe to test.
Live delivery
The link shows up the instant it is sent, so a slow click never risks it expiring first.
Preview and raw HTML
See the rendered email and the underlying markup, and confirm the link's real destination.
Shared with your team
Give QA teammates access to just the inbox they need to test login.
Also testing password resets or team invites? See every guide in email testing guides.
Magic link email testing FAQ
How do I test a magic link login email?
Create a private test inbox, request a magic link with that address, and click it once to confirm sign-in works. Then click the same link again to confirm it is rejected, and check that an expired link fails safely.
Why did my magic link stop working before I clicked it?
Some mail clients and security tools open links automatically to scan them, which can consume a single-use link before a person ever clicks it. If this matters for your product, design the flow to require an explicit confirmation step rather than signing in on the first request.
How long should a magic link stay valid?
Most products use 10 to 30 minutes for a login link. Test that an expired link shows a clear message and that requesting a new one invalidates the old link.
Can I test magic links across staging, QA, and production separately?
Yes, create a separate project or inbox per environment. Each keeps its own address, so a link from one environment never gets confused with another.
Does this work with Clerk, Auth0, Supabase Auth, or a custom passwordless flow?
Yes. Inceptmail addresses receive mail from anywhere, so it does not matter which service sends the login email, only that it is addressed to your test inbox.
Is Inceptmail free for testing magic links?
Yes. The Free plan includes 500 emails a month, 3 inboxes per project, and 7 days of message history, with no credit card needed.
Give your test email a proper home.
Create your first inbox in under a minute. The Free plan covers a whole project.
Get started free