An email containing a link — clicking it logs the user in, no code to type. threshold1 redirects back to a URL you specify, with the session attached.
Magic link needs one dashboard step: the origin of the redirectUrl you use has to be in the project's Allowed Origins list. This is the same list and the same mechanism passkey uses for its own origin check — covered in full on the Passkey-first & smart fallback page, including the fact that localhost is explicitly fine to add there (unlike passkey's domain requirement). Don't repeat that setup here — add your origin once and both methods benefit.
const auth = new Threshold1({
apiKey: "th_test_...",
redirectUrl: "https://yourapp.com/welcome", // origin must be in Allowed Origins
});
await auth.register("user@example.com"); // or login() — queues the email
Sending a magic link doesn't establish a session by itself — it only queues an email. The session is created later, when the link is clicked and lands back on your redirectUrl with a token attached. Call resumeSession() on that page's load to pick it up:
const user = await auth.resumeSession();
if (user) {
// Logged in via the magic link.
}
resumeSession() checks the URL for a t1_token query parameter, stores it, and cleans the URL so the token doesn't stay visible or get bookmarked. onAfterAuth fires here, not at send time — this is the one auth path where the two are separated in time.
Neither is currently configurable per project.
resumeSession() throws if the link was already used or has expired — surfaced as expired. See the Error Reference for the full picture.