---
title: "Test Auth.js (NextAuth) magic-link sign-in emails · Proxy Mail QA"
description: "Test Auth.js email sign-in: the magic link from Resend, Nodemailer or SendGrid, its 24-hour expiry, and why your email provider's sandbox stops it arriving."
url: https://proxymail.qa/auth/authjs
---

1. [Home](https://proxymail.qa/)
2. [Auth providers](https://proxymail.qa/auth)

# Test Auth.js magic-link emails

Auth.js (NextAuth.js) signs people in by email with a magic link, sent through the provider you configure: Resend, Nodemailer with SMTP, SendGrid, Postmark, Mailgun and others. To test it, request a link with a fresh Proxy Mail QA address and it shows up on the address's row. If nothing arrives, your email provider is usually still in its sandbox or test mode.

Updated October 17, 2026

Details below are from the Auth.js documentation on 17 October 2026\. Check it for current details.

## How Auth.js email sign-in works

1. The user enters their address on your sign-in page.
2. Auth.js stores a verification token in your database (a database adapter is required) and emails a magic link through your email provider.
3. Opening the link within 24 hours signs the user in, and uses the token up.

## Why the email doesn’t arrive

Auth.js hands the email to your provider, so its rules apply. Providers in sandbox or test mode only send to verified addresses: Resend without a verified domain, Amazon SES before production access, Mailgun sandbox domains, Postmark before approval. A test inbox can’t receive their mail until that’s sorted. [Test email not arriving?](https://proxymail.qa/troubleshooting) covers each one.

Also check the link’s host: Auth.js builds it from your site’s URL setting (`AUTH_URL`, or `NEXTAUTH_URL` in older versions), so a leftover `localhost` value sends people there. See [why emails link to localhost](https://proxymail.qa/solve/localhost-links).

## Test it by hand

1. Create an address in Proxy Mail QA.
2. Request a sign-in link with it on your app.
3. The link appears on the address’s row within seconds, marked as a sign-in link. Open it, then try it again: it should no longer work.

## Automate it

signin.spec.ts

```ts
import { test, expect } from 'proxymail-qa/playwright';

test('email sign-in works once', async ({ page, qa }) => {
  const { address } = await qa.createAddress();
  const requested = new Date();
  await page.goto('/api/auth/signin');
  await page.getByLabel('Email').fill(address);
  await page.getByRole('button', { name: 'Sign in with Email' }).click();

  const { value: link } = await qa.waitForLink(address, { type: 'magic_signin', since: requested });
  await page.goto(link);
  await expect(page).toHaveURL(/\/$/);
});

```

Match the page and labels to your sign-in form. More in [Test sign-up emails in Playwright](https://proxymail.qa/solve/playwright-email-tests) and [magic-link testing](https://proxymail.qa/solve/magic-link-testing).

## Try it on your next sign-up test

Free plan, no credit card. Create an address and watch the code or link arrive.

[Create a free account](https://app.proxymail.qa/?mode=signup)

## Questions

### Does Auth.js send a code instead of a link?

Its email providers send a magic link. The token in it is stored in your database, which is why email sign-in needs a database adapter.

### How long does an Auth.js sign-in link last?

Auth.js's docs say the user has 24 hours to click it. The token is used up when it's opened, so a link opened once can't sign in again.

### Why do some sign-in links already say they've been used?

Some email security scanners open links before the user does, using up single-use tokens. Proxy Mail QA never opens or prefetches links, so the link still works when you open it.

## Related guides

- [Supabase AuthConfirmation, magic-link, code and reset emails, and why the default sender won't email your test addresses.](https://proxymail.qa/auth/supabase)
- [ClerkVerification codes, email links and resets, when test-mode addresses aren't enough, and the development email cap.](https://proxymail.qa/auth/clerk)
- [Auth0Verification links, passwordless codes and resets, and the built-in email provider's limits.](https://proxymail.qa/auth/auth0)
- [Firebase AuthenticationVerification, reset and email-link sign-in emails on the web, and the daily sending limits.](https://proxymail.qa/auth/firebase)
- [Better AuthVerification, reset, magic-link and email OTP emails through your own provider, and their short expiry.](https://proxymail.qa/auth/better-auth)

[See every email testing problem we solve](https://proxymail.qa/solve)

Auth.js and NextAuth.js are trademarks of their owners. Proxy Mail QA is independent and isn't affiliated with or endorsed by them.