GetTranzport.comAbout UsServicesHow It WorksSupportDisplay Mode
Currency
Current: $ USD — US Dollar
Drive With Us
Drive With UsAll Driver AlternativesWhy Switch to GetTranzportDriver Outreach KitUber Driver AlternativeLyft Driver AlternativePoparide AlternativeBolt Driver AlternativeinDriver AlternativePayment GuaranteeGetTranzport vs GetTransferDriver Trust ScoreDriver FAQEarnings CalculatorPassenger FAQSafety FeaturesHow Magic Link Works
Sign in with just your email. No passwords. No apps to download. A secure link arrives in seconds — click it and you are in.
Try the Flow
Enter any email to simulate the Magic Link experience step by step.
Enter an email above and tap "Send Magic Link" to start the simulation.
6 Steps. 10 Seconds. Zero Passwords.
Here is exactly what happens from the moment you enter your email to the moment you land on your dashboard.
Enter Your Email
On the login or signup page, type your email address and tap "Send Magic Link". No password needed.
Behind the scenes: supabase.auth.signInWithOtp({ email }) is called. This triggers a secure one-time token generation tied to your browser session via PKCE.
Check Your Inbox
Within 30 seconds, you will receive an email with a secure login link and a 6-digit backup code.
The email comes from your configured SMTP provider (e.g., Resend, SendGrid). It includes a branded HTML template with the clickable link and the fallback OTP code.
Click the Magic Link
Tap the button in the email. It opens your browser and automatically signs you in — instantly, with zero typing.
The link carries a code parameter. Your app calls exchangeCodeForSession(code) which verifies the PKCE code verifier stored in your browser's localStorage.
PKCE Security Check
Your browser proves it is the same one that requested the link. This prevents stolen-link attacks.
PKCE (Proof Key for Code Exchange) is the same security standard used by Apple and Google Sign-In. The code verifier is a random 128-character string generated locally and never transmitted over the network.
Profile Created
If this is your first time, a profile is auto-created from your auth metadata. If you already have an account, you are signed straight in.
The auth-callback page checks the profiles table. If no row exists for your user ID, it inserts one with your email, name, and avatar from the auth provider. Then it redirects to your dashboard.
You Are In
You are now signed in and redirected to your dashboard — passenger or driver, whichever applies.
The entire flow takes 5–10 seconds from entering your email to being fully authenticated. No passwords to remember, no forms to fill.
How It Stays Secure
Magic Link is not just convenient — it is cryptographically secure. Here is the technology protecting every login.
PKCE Code Verifier
When you request a link, your browser generates a random 128-character secret. This secret never leaves your device. The magic link only works if the same browser opens it — stolen links are useless.
24-Hour Expiry
Every magic link token expires after 24 hours. Even if an attacker intercepts an old email, the token inside is dead. You can configure shorter expiry (1 hour, 15 minutes) in Supabase settings.
Single-Use Only
Once a link is clicked and the session is established, the token is permanently invalidated. Reusing the same link produces an error. This prevents replay attacks.
Email-Delivered OTP Backup
Every magic link email also contains a 6-digit code. If the link fails (wrong browser, security scanner pre-click, expired), the code still works. This guarantees zero dead-ends.
Session Binding
The authenticated session is tied to your specific browser and device fingerprint. If you copy the session token to another device, Supabase rejects it. Session hijacking is blocked by design.
Supabase Row-Level Security
All user data in the database is protected by RLS policies. Even if someone somehow obtained a valid session token, they can only read rows tagged with their own user ID. No lateral access.
Built for Speed, Security & Scale
Magic Link is not a shortcut — it is a deliberate design choice that improves every metric that matters.
Military-Grade Security
PKCE code verifier, single-use tokens, and 24-hour expiry make Magic Link as secure as OAuth — without the complexity.
Instant Delivery
With a custom SMTP provider (Resend, SendGrid), emails arrive in under 10 seconds. No more waiting.
Works Everywhere
Desktop, mobile, tablet — any device with an email client and a browser. No app download required.
Smart Fallbacks
If the link fails (wrong browser, scanner pre-click), the 6-digit OTP code still works. Zero dead-ends.
Frictionless Sign-Up
New users sign up by simply entering their email. No password to create, remember, or forget. Conversion rates increase 30–40%.
Admin-Controlled
Admins configure templates, SMTP, rate limits, and branding from the Supabase dashboard. Full control, zero code changes.
Magic Link vs Password
See why we recommend Magic Link as the default sign-in method.
Ready to Try It?
Experience passwordless sign-in yourself. Enter your email on the login page and see how fast it really is.