--- title: "Login methods explained: email, codes, magic links, Google and more · Proxy Mail QA" description: "Passwords, one-time codes, magic links, Google or Apple sign-in, phone codes and SSO in plain words: what each sends, what breaks, and how to test it." url: https://proxymail.qa/built-with/login-methods --- 1. [Home](https://proxymail.qa/) 2. [AI app builders](https://proxymail.qa/built-with) # Login methods explained, and how to test each one Ask Lovable, Replit, Bolt, v0 or your coding agent to add login and you get a choice: email and password, a code, a magic link, a Google button, a phone number. Here's what each one does, which emails it sends, what usually goes wrong, and how to check it before your users find out. Updated October 15, 2026 ## At a glance | Login method | What your users do | Emails it sends | Test it with Proxy Mail QA | | ---------------------------------- | ------------------------------------------- | ------------------------------------------ | ------------------------------------- | | Email and password | Choose a password, then confirm their email | Confirmation, password reset, email change | Yes, every one | | Email code | Type a short code from an email | A new code each time they sign in | Yes, with a Copy button | | Magic link | Click a link in an email | A new link each time they sign in | Yes, and we never open the link first | | Google, Apple, Microsoft or GitHub | Click a button and pick their account | None to sign in | No: use a real account you own | | Phone code | Type a code from a text message | None: it’s a text | No: we receive email only | | Company sign-in (SSO) | Sign in through their employer’s login | None to sign in | No | Whichever you choose, your app still sends its own emails, such as invites, receipts and notifications. You can check those arrive and link to the right place with any login. ## Email and password The one everyone knows. People choose a password, and if **email confirmation** is on, they get an email with a link or a code and can’t sign in until they use it. **Emails it sends:** a sign-up confirmation, password resets, and an email to confirm a new address when someone changes theirs. **What usually goes wrong:** - **Confirmation is off,** so anyone can sign up with an address that isn’t theirs, or a typo, and you can never reach them. - **Confirmation is on, but the email never arrives,** often because the app still uses the starter email sender from its builder or database, which has low limits. [Why emails don’t arrive](https://proxymail.qa/troubleshooting). - **The link opens localhost** or a preview address instead of your published app. [How to fix it](https://proxymail.qa/solve/localhost-links). - **The password reset link** lands on a page with no way to choose a new password. **Test it:** sign up with a fresh address and use the link or code. Sign out and back in. Then ask for a password reset and finish it. [Step by step](https://proxymail.qa/solve/password-reset-testing). ## Email codes People type their email, get a short code (often 6 digits) and type it in. There’s no password to remember. Some apps also use a code to confirm sign-up: Base44 and Clerk both do. **Emails it sends:** a new code every time someone signs in. **What usually goes wrong:** - The code expires before the email arrives. - Asking for a second code doesn’t cancel the first, or cancels both. - Someone who asks twice gets “too many requests” and is locked out. **Test it:** ask for a code and use it. Ask for two in a row and check that only the newest works. Proxy Mail QA shows a countdown when the email says how long the code lasts. [More on testing codes](https://proxymail.qa/solve/otp-code-testing). ## Magic links People type their email and click the link you send them. One click, no password. **Emails it sends:** a new link every time someone signs in. **What usually goes wrong:** - The link opens localhost instead of your app. - The link fails in a different browser, or on a phone where the mail app opens its own browser. - Email security scanners at some workplaces open links before the person does, which uses them up. **Test it:** ask for a link and open it in the same browser, then try it on another device. Check that a used or expired link explains what to do. Proxy Mail QA never opens or prefetches links, so yours is still fresh when you click it. [More on magic links](https://proxymail.qa/solve/magic-link-testing). ## Google, Apple, Microsoft and GitHub buttons People click **Continue with Google** (or Apple, Microsoft or GitHub) and pick their account. Your app never handles a password, which is why AI app builders add these so readily. **Emails it sends:** none to sign in. The provider handles it. **What usually goes wrong:** - **It works in the preview but fails on your published app or custom domain.** The new address isn’t on the provider’s list of allowed redirects, and Google shows `redirect_uri_mismatch`. - **The sign-in screen shows your builder’s name, not your app’s.** Lovable and Base44 both offer a shared setup that works straight away. Switch to your own credentials before launch if that matters to you. - **Someone signs up with email and password, then later clicks Continue with Google** with the same address. Decide whether that should be one account or an error, and test it. - **Sign in with Apple can hide people’s email.** Your app gets an address ending in `privaterelay.appleid.com`, and your emails only reach the person if you’ve registered your sending domain with Apple. **Test it:** these buttons need a real account, so use a Google or Apple account you own, on the published app as well as the preview. ## Phone codes People type their phone number and get a code by text message. It needs an SMS provider such as Twilio, and each text costs money. Proxy Mail QA receives email only, so it can’t help here. ## Company sign-in (SSO) For apps sold to businesses: staff sign in through their employer’s login, such as Okta or Microsoft Entra ID, usually over a standard called SAML. Lovable and Base44 both support it. It sends no email to sign in, but team invites usually still go by email. ## Signing in with the builder’s own account Some builders let people sign in with an account on the builder itself. With **Replit Auth**, your users sign in with a Replit account on a Replit-branded page, and Replit sends the emails, such as password resets. Lovable offers **Sign in with Lovable** too. That suits internal tools and apps for other builders. For a public app you’ll usually want your own accounts: on Replit, that’s **Clerk Auth**. ## What should a new app use? For most apps: **email plus Google.** - **Google** is the quickest sign-up for most people. - **Email** covers everyone else: people without Google, people using a work address, and anyone who’d rather not link their account. - **Prefer codes or magic links** if you don’t want passwords. Codes work better when people read email on their phone but use your app on a laptop. - **Keep email confirmation on,** and send email from your own domain before you launch. ## Which login does your builder set up? | Built with | Login it gives you | Sign-in options | | ------------------------------------------------------------------------------------------------------------------------------------------------------------ | ---------------------------------------------------------------- | ------------------------------------------------------------------------------------ | | [Lovable](https://proxymail.qa/built-with/lovable) | Lovable Cloud, or your own Supabase project | Email (the default), Google, Apple, Microsoft, phone, SAML SSO, Sign in with Lovable | | [Replit](https://proxymail.qa/built-with/replit) | Replit Auth (Replit accounts), or Clerk Auth (your own accounts) | Email, Google, GitHub, Apple, X | | [Bolt](https://proxymail.qa/built-with/bolt) | Bolt’s built-in database | Email, Google | | [Base44](https://proxymail.qa/built-with/base44) | Base44’s built-in login | Email and password with an emailed code, Google, Microsoft, Facebook, company SSO | | [v0](https://proxymail.qa/built-with/v0) | Usually Supabase, sometimes Clerk | Email and password, codes, magic links, Google and others | | [Antigravity](https://proxymail.qa/built-with/antigravity) | Usually Firebase Authentication | Email and password, email links, Google and others | | [Claude Code](https://proxymail.qa/built-with/claude-code), [Codex](https://proxymail.qa/built-with/codex), [Cursor](https://proxymail.qa/built-with/cursor) | Whatever you ask for | Usually Supabase, Clerk, Firebase, Auth.js or Better Auth | ## Login services coding agents use When you build with a coding agent, it wires your app to a login service. Each sends different emails, and each has one thing that breaks them most often: | Login service | Emails it sends | What most often breaks them | | ----------------------- | ---------------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------- | | Supabase Auth | Confirmation, magic link or code, password reset, invite, email change | The Site URL, and the built-in sender, which only delivers to your Supabase team, 2 an hour, until you set up custom SMTP | | Clerk | A verification code (or link), sign-in codes, password reset codes | Development and production are separate, with separate users; production needs your own domain’s DNS records | | Firebase Authentication | Verification link, password reset link, email-link sign-in | People can sign in before verifying unless your app checks; links must point at an authorized domain | | Auth.js | Magic links, through an email provider such as Resend | Password sign-up has no emails built in: verification and resets are code you add | | Better Auth | Verification, password reset, and magic links or codes through plugins | It calls a send function you write, so nothing goes out until that’s connected to an email provider | ## Try it on your next sign-up test Free plan, no credit card. Create an address and watch the code or link arrive. [Create a free account](https://app.proxymail.qa/?mode=signup&from=login-methods) ## Questions ### Can Proxy Mail QA test Sign in with Google? Not the sign-in itself. Google handles it, sends no email, and needs a real Google account, so test it with an account you own, on your published app. Proxy Mail QA covers every login that works by email, and the other emails your app sends. ### Codes or magic links: which is better? Codes work across devices: someone can read the email on their phone and type the code on their laptop. Links are one click, but often only work in the browser that asked for them. If you're not sure, codes are the safer choice. ### Should I turn on email confirmation? Yes, for most apps. It proves the address is real and belongs to the person signing up, so password resets, receipts and other emails reach them. Test it again whenever you change your login. ### Do I still need email if my app only has Google sign-in? Usually. Invites, receipts, notifications and account emails still go out by email, and not everyone has a Google account or wants to use it for your app. ## Related guides - [LovableWhich Lovable Cloud logins send email, the Site URL and sender settings, and a check before you launch.](https://proxymail.qa/built-with/lovable) - [ReplitReplit Auth, Clerk Auth or your own: which send email, and how to test each on the published app.](https://proxymail.qa/built-with/replit) - [BoltTurn on email confirmation, fix the localhost Site URL and test every auth email before you publish.](https://proxymail.qa/built-with/bolt) - [Base44Test the sign-up code, password reset and invites, and every user role, with a test account per role.](https://proxymail.qa/built-with/base44) - [v0Set Supabase’s Site URL and redirects for Vercel deployments, or move Clerk to production, then test every login email.](https://proxymail.qa/built-with/v0) - [Claude CodeCheck the auth emails in apps you build with Anthropic’s coding agent, from localhost to staging.](https://proxymail.qa/built-with/claude-code) - [OpenAI CodexRun the real email flow once before you merge a Codex change that touches sign-up or login.](https://proxymail.qa/built-with/codex) - [CursorCheck the real sign-up, magic-link and reset emails after the agent changes your auth code.](https://proxymail.qa/built-with/cursor) - [Google AntigravityKeep unverified Firebase users out, check authorized domains and the sender, and let the agent run the check.](https://proxymail.qa/built-with/antigravity) - [QoderCheck the real sign-up, code and reset emails after the agent changes your auth code, or let it check them itself.](https://proxymail.qa/built-with/qoder) [See every email testing problem we solve](https://proxymail.qa/solve) Google, Apple, Microsoft, GitHub, Lovable, Replit, Bolt, Base44, v0, Antigravity, Supabase, Clerk, Firebase and Better Auth are trademarks of their respective owners. Proxy Mail QA is independent and isn't affiliated with or endorsed by them.