---
title: "Magic link postlogin"
method: POST
path: "/resources/auth/v1/passwordless/magiclink/postlogin"
tags: ["Passwordless"]
---

# Magic link postlogin

`POST /resources/auth/v1/passwordless/magiclink/postlogin`

## Request

- Base URL: `http://localhost:8181`
- URL: `http://localhost:8181/resources/auth/v1/passwordless/magiclink/postlogin`
- Auth: HTTP bearer
- TypeScript: <https://skmtc.dev/frontegg/apis/entitlements-agent-pdp/docs/resources/auth/v1/passwordless/magiclink/postlogin/post.ts> (a function with typed inputs; its response is checked against the schema)

This route authenticates a local user and is the second step when using the magic link passwordless mechanism. Send the **`frontegg-vendor-host`** as a header to declare which vendor. This is your domain name in the Frontegg Portal ➜ Workspace Settings ➜ Domains ➜ Domain Name. Send the user's token id as POST body params. Include the invitation token if the user is signing up by invitation. Send the recaptcha token if the recaptcha is enabled for login. The route returns the refresh cookie and JWT.

## Request body

- AuthenticateUserPasswordlessDto
  - `token` string, required: One time code to login with - get it from the email sent after prelogin request
  - `recaptchaToken` string
  - `invitationToken` string

## Response `201`

- AuthenticationResponseDto
  - `tokenType` string
  - `mfaRequired` boolean, required
  - `mfaToken` string
  - `mfaEnrolled` boolean
  - `mfaDevices` UserMFADevicesResponse
    - `webauthn` UserMFAWebAuthnDeviceResponse[], required
      - `id` string, required
      - `deviceType` 'Platform' | 'CrossPlatform', required
      - `name` string, required
    - `phones` UserMFAPhoneDeviceResponse[], required
      - `id` string, required
      - `phoneNumber` string, required
    - `authenticators` UserMFAAuthenticatorAppResponse[], required
      - `id` string, required
    - `emails` UserMFAEmailCodeResponse[], required
      - `email` string, required
  - `mfaStrategies` object
  - `qrCode` string
  - `recoveryCode` string
  - `accessToken` string, required
  - `refreshToken` string, required
  - `expiresIn` number, required
  - `expires` string, required
  - `userId` string
  - `userEmail` string
  - `emailVerified` boolean
  - `isBreachedPassword` boolean

---

[API](https://skmtc.dev/frontegg/apis/entitlements-agent-pdp.md) - [All operations](https://skmtc.dev/frontegg/apis/entitlements-agent-pdp/llms.txt) - [OpenAPI document](https://skmtc.dev/frontegg/apis/entitlements-agent-pdp/revisions/c496ae9e1c3e?raw)