Passwords are the worst part of onboarding.
Passwords kill conversion
Every password requirement at signup costs you new users — especially on B2B trials.
Onboarding is multi-step
Invitation, email verification, password setup — by the time the user finishes, they've forgotten why they signed up.
Reset flows are fragile
Forgot-password flows are an attack surface, a support cost, and a deliverability headache all at once.
Make email the credential
One signed link, one session
The link is the credential. HMAC-signed, single-use, expires fast.
API-triggered for invites
Generate a magic link from your backend whenever you need one — onboarding, verification, recovery.
Drop-in login flow
Adds a 'Sign in with magic link' option to the standard Keycloak login screen.
Configurable everywhere
TTL, redirect URI, template, per-realm — tune it for the use case.
Where magic links shine
Anywhere the user has an email and you'd rather not deal with a password.
Everything a production magic link needs
HMAC-signed URLs
Tamper-evident. Server validates every link.
Single-use tokens
Token is consumed on first valid click.
Configurable TTL
Short for sign-in, longer for invitations.
API endpoint
POST /magic-link to generate a link from your backend.
Template integration
Plays nicely with the Themes extension for branded emails.
Per-realm config
Different rules per tenant when needed.