Building a Passwordless Login Flow with Email Links

Issue a short-lived random one-time login token and email only its HTTPS link; store a hash server-side.

The objective is to understand the behavior and operational limits, not only the method name.

What It Does

Issue a short-lived random one-time login token and email only its HTTPS link; store a hash server-side.

Prerequisites

Use a dedicated development environment and sample data. Where a snippet uses an injected connection, repository, request value or mailer, supply it from your own application setup.

Example 1: Basic Use

A focused working pattern for this topic. Names such as $pdo, $authContext and $repo represent dependencies provided by the application unless initialized in the snippet.

<?php
$raw = bin2hex(random_bytes(32));
$hash = hash('sha256', $raw);
$stmt = $pdo->prepare('INSERT INTO login_links(user_id, token_hash, expires_at) VALUES (?, ?, ?)');
$stmt->execute([$userId, $hash, date('Y-m-d H:i:s', time()+900)]);
// Send the raw token in an HTTPS link; never store it as plaintext.

Example 2: A Second Scenario

A second use case that adds a different operation or data flow specific to this topic.

<?php
$presentedHash = hash('sha256', $tokenFromLink);
$pdo->beginTransaction();
try {
    $stmt = $pdo->prepare('UPDATE login_links SET used_at = CURRENT_TIMESTAMP WHERE token_hash = ? AND used_at IS NULL AND expires_at > CURRENT_TIMESTAMP');
    $stmt->execute([$presentedHash]); if ($stmt->rowCount() !== 1) throw new RuntimeException('Link expired or already used');
    $pdo->commit();
} catch (Throwable $e) { if ($pdo->inTransaction()) $pdo->rollBack(); throw $e; }

Example 3: Practical Checks

A practical validation, failure or deployment concern specific to this topic.

<?php
session_regenerate_id(true);
$_SESSION['user_id'] = $authenticatedUserId;
$_SESSION['logged_in_at'] = time();
// Consume login token in a separate POST request, never by following a GET link.

Important Behavior and Edge Cases

Mark the token as used atomically, rate-limit issuance and protect against link scanners consuming GET links.

For production use, also account for error handling, data validation, resource limits and environment-specific driver behavior.

Comparison with Related Approaches

Common Beginner Mistakes

Key Takeaways

• Issue a short-lived random one-time login token and email only its HTTPS link; store a hash server-side.
• Mark the token as used atomically, rate-limit issuance and protect against link scanners consuming GET links.
• Use this workflow as a focused starting point rather than a substitute for application-level tests.

Choose this API or pattern when its exact semantics match your task, and verify the result against the database driver and runtime used by your application.