Magic links are popular in AI-built apps because they are a built-in option in Supabase Auth and Firebase Authentication and remove password handling altogether. There is no password to store, reuse or leak. The user types an email address, receives a link containing a single-use token, and clicking it creates a session.
The security of the scheme moves to two places: the user's inbox and the link itself. The link is a credential for as long as it is valid, so it should expire quickly and work once. Configuration matters too. If your auth provider will redirect to any URL after login, an attacker can craft a login link that sends the resulting session to a site they control, so the allowed redirect URLs must be an exact list. An open sign-in form can also be abused to send large volumes of email to addresses that never asked for it.
Set a short expiry, keep the redirect allowlist limited to your real domains with no wildcards, rate limit the request endpoint and add a CAPTCHA if it is abused. Show the same response whether or not the email address has an account, so the form cannot be used to discover who your users are.