Passwordless login
Users authenticate without passwords by receiving a one-time sign-in link by email.
Auth.js · Const
Mailgun
Mailgun enables passwordless Auth.js sign-in by emailing magic links with verification tokens. It requires a database adapter for token storage and supports JWT or database-managed sessions.
How it works
Mailgun sends passwordless sign-in links containing verification tokens. Auth.js stores those tokens through a database adapter, and the token is valid for 24 hours by default; the provider can use either JWT or database sessions after the required database is configured.
Syntax
Mailgun(config)Parameters
| Name | Type | Description |
|---|---|---|
config | EmailUserConfig & { region: "US" | "EU" } | Email provider configuration plus the Mailgun server region, either US or EU. |
Returns
EmailConfig
Key points
- Mailgun provides passwordless authentication by emailing users links that contain sign-in tokens.
- A verification token normally expires after one day.
- Using the link before expiration creates the account on an initial sign-in and authenticates the user.
- Either JWT-based or database-backed session management can be selected, subject to the database requirement.
- Store the Mailgun API key in AUTH_MAILGUN_KEY to configure credentials through the environment.
- A differently named API-key variable must be supplied explicitly in the provider configuration.
Common mistakes
- Email sign-in requires a configured database adapter; sessions alone cannot remove this requirement.
- Set the region option for Mailgun's EU server; omit it when using the US server.
- The sending domain must first be added to your Mailgun account and must match the provider's from address domain.
Example: Configure Mailgun email sign-in
import { Auth } from "@auth/core"
import Mailgun from "@auth/core/providers/mailgun"
const request = new Request("https://example.com")
const response = await Auth(request, {
adapter,
providers: [
Mailgun({
from: process.env.MAILGUN_DOMAIN!,
region: "EU",
}),
],
})This configures Auth.js with Mailgun email sign-in, using the Mailgun domain as the sender and the EU endpoint.
When to use it
Combine email and OAuth sign-in
An application needs email authentication alongside social login providers.
EU Mailgun delivery
A deployment sends mail through Mailgun's European service.
Interview questions
QHow does Mailgun authentication work?
Mailgun is an email provider that sends a magic link containing a verification token. When the recipient uses a valid link, Auth.js creates the account on first sign-in and signs the user in; the default token lifetime is 24 hours.
Follow-up: What persistence is required? A database adapter must store the email verification token, even if sessions are managed with JWTs.
QWhat does the Mailgun provider function accept and return?
The provider accepts an EmailUserConfig together with a region of either US or EU, and returns an EmailConfig. A typical configuration supplies the sender domain through from and optionally sets region: "EU".
Follow-up: How can the API-key configuration stay implicit? Name the environment variable AUTH_MAILGUN_KEY so the provider discovers it automatically.
QHow is Mailgun configured operationally?
The provider can be registered in the Auth.js providers array. The Mailgun API key can be stored in AUTH_MAILGUN_KEY; using that exact name lets the provider pick it up without passing the key manually.
Follow-up: What else must be configured before sign-in works? Add a database adapter, then start the flow at the application's /api/auth/signin endpoint.
Related
EmailConfigEmailUserConfigVerification Tokendatabase adapterJSON Web TokenAUTH_MAILGUN_KEY