37signals-auth

Passwordless authentication in Rails uses email-based magic links to sign users in without passwords. You wire up Identity, Session, and MagicLink models with has_secure_token to generate links and manage secure sessions via signed cookies.

A lightweight Devise alternative for passwordless sign-in uses custom Identity, Session, and MagicLink models instead of a heavy gem. It provides email-based magic link delivery and database-backed token sessions for Ruby on Rails 8.2+ applications.

Yes, passwordless magic links support API clients in Rails. The authentication flow includes optional password support specifically for API access, alongside end-to-end sign-in, sign-out, and session renewal flows for both web and API environments.

Session management in a passwordless Rails app uses database-backed Session models with has_secure_token and signed cookies. When a user clicks a magic link, the system validates the token and establishes a secure, active session for web or API clients.

No, you do not need Devise to implement magic link authentication in Ruby on Rails. You can build a lightweight, secure sign-in flow using built-in features like has_secure_token, database-backed models, and signed cookies for session handling.

Magic link session management relies on email delivery, meaning sign-in fails if the user's email is inaccessible or delivery is delayed. It also requires database-backed MagicLink and Session models to handle token generation, validation, and expiration securely.