The authentication flow begins when a user enters their email and selects the magic link option on the login page. The frontend sends this request to the backend (/api/v1/login), which uses Descope to generate and send a magic link email containing a token and the /verify remix route. When the user clicks the link, they are directed to /verify?t=<token>. At this point, the WAF challenge is triggered before the request reaches our application. This was introduced because some email security products used by new clients automatically clicked links in a sandbox environment, causing the one-time magic link to expire before the user ever saw it in their inbox. By placing the challenge at the WAF level, only real users can consume the link, preventing premature expiration. After passing the challenge, the Remix /verify route validates that the user is anonymous, checks for a token or session email, and, if needed, posts the token to the backend (/api/v1/verify). On successful verification, the backend responds with session and refresh cookies while destroying the temporary verify session. Finally, the user is redirected to the application’s main page as an authenticated user, with proper cookies set for subsequent requests.

Authentication via Magic Link Flow