This is the function users trigger when they submit the login form. It generates a cryptographically secure token, saves it to the database, and fires the email.

Create it at lib/auth/requestMagicLink.ts:

// lib/auth/requestMagicLink.ts
"use server";
import crypto from "crypto";
import { db } from "@/lib/db"; // your database query helper
import { sendMagicLinkEmail } from "./sendMagicLinkEmail";
export async function requestMagicLink(email: string) {
    // 1. Generate a secure random token
    const token = crypto.randomBytes(32).toString("hex");
    // 2. Set expiry to 15 minutes from now
    const expiresAt = new Date(Date.now() + 15 * 60 * 1000);
    // 3. Delete any existing tokens for this email (one active link at a time)
    await db.query(
        `DELETE FROM verification_tokens WHERE email = $1`,
        [email]
    );
    // 4. Insert the new token
    await db.query(
        `INSERT INTO verification_tokens (email, token, expires_at)
     VALUES ($1, $2, $3)`,
        [email, token, expiresAt]
    );
    // 5. Send the email
    await sendMagicLinkEmail(email, token);
}

Security note: We delete any previous tokens for that email before inserting the new one. This ensures only one valid link exists at a time, preventing token accumulation.

Step 5: The Login Form

Wire up a simple login form that calls the requestMagicLink. Create app/login/page.tsx:

// app/login/page.tsx
"use client";
import { useState } from "react";
import { requestMagicLink } from "@/lib/auth/requestMagicLink";
export default function LoginPage() {
  const [email, setEmail] = useState("");
  const [submitted, setSubmitted] = useState(false);
  const [loading, setLoading] = useState(false);

  async function handleSubmit(e: React.FormEvent) {
    e.preventDefault();
    setLoading(true);

    try {
      await requestMagicLink(email);
      setSubmitted(true);
    } catch (err) {
      console.error(err);
      alert("Something went wrong. Please try again.");
    } finally {
      setLoading(false);
    }
  }

  if (submitted) {
    return (
      <div>
        <h1>Check your email</h1>
        <p>We sent a login link to <strong>{email}</strong>. It expires in 15 minutes.</p>
      </div>
    );
  }

  return (
    <div>
      <h1>Log in</h1>
      <form onSubmit={handleSubmit}>
        <input
          type="email"
          placeholder="you@example.com"
          value={email}
          onChange={(e) => setEmail(e.target.value)}
          required
        />
        <button type="submit" disabled={loading}>
          {loading ? "Sending..." : "Send login link"}
        </button>
      </form>
    </div>
  );
}

Step 6: The Magic Link Route Handler

This is the heart of the flow. When the user clicks the link in their email, this route validates the token, creates a session, and redirects them. Create app/api/auth/magic-link/route.ts:

// app/api/auth/magic-link/route.ts
import { NextRequest, NextResponse } from "next/server";
import { db } from "@/lib/db";
import { cookies } from "next/headers";

export async function GET(request: NextRequest) {
    const token = request.nextUrl.searchParams.get("token");
    // 1. Token must be present
    if (!token) {
        return NextResponse.redirect(new URL("/login?error=missing-token", request.url));
    }
    // 2. Look up the token in the database
    const result = await db.query(
        `SELECT * FROM verification_tokens WHERE token = $1`,
        [token]
    );
    const record = result.rows[0];
    // 3. Token must exist
    if (!record) {
        return NextResponse.redirect(new URL("/login?error=invalid-token", request.url));
    }
    // 4. Token must not be expired
    if (new Date(record.expires_at) < new Date()) {
        await db.query(`DELETE FROM verification_tokens WHERE token = $1`, [token]);
        return NextResponse.redirect(new URL("/login?error=expired-token", request.url));
    }
    // 5. Consume the token (delete it so it can't be reused)
    await db.query(`DELETE FROM verification_tokens WHERE token = $1`, [token]);
    // 6. Find or create the user
    let userResult = await db.query(
        `SELECT * FROM users WHERE email = $1`,
        [record.email]
    );
    if (userResult.rows.length === 0) {
        userResult = await db.query(
            `INSERT INTO users (email) VALUES ($1) RETURNING *`,
            [record.email]
        );
    }
    const user = userResult.rows[0];
    // 7. Create a session (here we use a simple signed cookie — swap in your session lib)
    const cookieStore = cookies();
    cookieStore.set("session_user_id", String(user.id), {
        httpOnly: true,
        secure: process.env.NODE_ENV === "production",
        sameSite: "lax",
        maxAge: 60 * 60 * 24 * 7, // 7 days
        path: "/",
    });

    // 8. Redirect to the app
    return NextResponse.redirect(new URL("/dashboard", request.url));
}

This is just a simple example of how to do this since I would recommend storing sessions in a Session db table and also using something like Drizzle or Prisma to handle the SQL. In this route, you can also add a rate limiter to prevent DDoS attacks.

Additionally, you might need to clean up the tokens when they expire if they have not been used by the user since this would free up space in the database. The best option is to use a cron job that runs at a specified time and checks for expired tokens in the verification table.

// app/api/cron/cleanup-tokens/route.ts
export async function GET() {
    await db.query(`DELETE FROM verification_tokens WHERE expires_at < NOW()`);
    return Response.json({ ok: true });
}

Summary

In this blog, we have covered how to implement magic link login without external auth libraries. Here is a full summary of the auth flow:

User submits email
       │
       ▼
requestMagicLink(email)
  ├─ generates token
  ├─ stores token + expiry in verification_tokens
  └─ calls sendMagicLinkEmail(email, token)
              │
              ▼
        User clicks link
              │
              ▼
GET /api/auth/magic-link?token=...
  ├─ validates token exists + not expired
  ├─ deletes token (one-time use)
  ├─ finds or creates user
  ├─ sets session cookie
  └─ redirects to /dashboard

Security Checklist

• Tokens are single-use—deleted immediately after validation
• Tokens expire—a 15-minute window limits exposure
• crypto.randomBytes(32) — 256 bits of entropy, not guessable
• httpOnly cookie—a session cookie is inaccessible to JavaScript
• One active token per email—old tokens are replaced on each request
• No user enumeration—the login form shows a success message whether or not the email exists in your database