--- title: "Test magic links and passwordless sign-in · Proxy Mail QA" description: "Test magic-link and passwordless email sign-in safely. Single-use links are never opened or prefetched on our side, so each one still works when you open it." url: https://proxymail.qa/solve/magic-link-testing --- 1. [Home](https://proxymail.qa/) 2. [What we solve](https://proxymail.qa/solve) # Test magic links and passwordless sign-in A magic link works once. If anything opens it before you do, the test fails for reasons that have nothing to do with your app. Proxy Mail QA never touches your links: they open only when you click them. Updated 11 October 2026 ## Why magic links are easy to break in testing - **They’re single-use.** Corporate email security, link previews and some mail apps open links to scan them. If that happens first, your click hits “link already used”. - **Several requests, several links.** Request two links and only the newest may work. In a shared inbox it’s hard to tell which is which. - **Device and browser rules.** Depending on your setup, the link may need to be opened in the same browser that requested it. - **Redirects.** After the sign-in completes, the user is redirected to your app. If that address is wrong, everything looks fine until the last step. ## How Proxy Mail QA helps 1. Create an address and request a magic link from your app. 2. The row shows a **Sign in** button the moment the email arrives. Nothing has opened the link before you. 3. Click it: it opens in a new tab with no referrer, just like a careful user’s mail app. 4. If the link, or the page it redirects to after signing in, points at `localhost` or another local address, we [flag it](https://proxymail.qa/solve/localhost-links) so you can tell a broken environment from a broken flow. ## What to check in a magic-link email - The link signs you in once, and a second click explains that it has been used. - Requesting a new link makes the old one stop working, if that’s your policy. - The expiry is stated in the email and matches what the app enforces. - Opening the link on another device does what you expect, with a clear message if it can’t complete there. - After signing in, the user lands on the page they were trying to reach. ## Automating this? Make it a test: waitForLink with type magic\_signin returns the link without opening it, so it is still unused when your test visits it. [Node.js client](https://proxymail.qa/docs/node) [Python](https://proxymail.qa/docs/python) [Set up your coding agent](https://proxymail.qa/docs/api#agent-setup) ## Try it on your next sign-up test Free plan, no credit card. Create an address and watch the code or link arrive. [Create a free account](https://app.proxymail.qa/?mode=signup&from=site-solve-magic-link-testing) ## Questions ### Do you open or scan the links in my emails? Never. Nothing on our side fetches, prefetches or follows a link. Links open only when you click them, in a new tab, without sending a referrer. ### Why does my magic link say it has expired or been used? Common causes are an email scanner or link previewer opening it first, clicking an older link after requesting a new one, or a short expiry. With Proxy Mail QA the first cause is ruled out, which narrows it down to your app. ### The link signs me in on one browser but not another. Is that a bug? Not necessarily. Some flows, such as PKCE-based sign-in, only complete in the browser that asked for the link. Test it on purpose and make sure the message on the other browser is helpful. ### Can I see the raw link? Yes. The inbox lists every link found in the email with its label, and the full message is shown in a locked-down frame. ## Related guides - [Test sign-up and email verificationA fresh, private address for every sign-up test, with the verification link or code ready the moment it lands.](https://proxymail.qa/solve/email-verification-testing) - [Test OTP and one-time login codesCodes pulled out of the email with a Copy button and a countdown when the email says how long they last.](https://proxymail.qa/solve/otp-code-testing) - [Test password reset emailsRequest, receive and use reset links, and keep the new password saved next to the test account.](https://proxymail.qa/solve/password-reset-testing) - [Stop sharing one Gmail inbox for QAPrivate, disposable addresses for every tester instead of one shared mailbox and a pile of plus-addresses.](https://proxymail.qa/solve/shared-test-inbox) - [Take QA notes by voice with Wispr FlowDictate what each test account is for, its state and what you found, straight into its notes, in seconds.](https://proxymail.qa/solve/voice-notes-wispr-flow) - [Verification link points to localhost:3000Why emails from staging link to localhost, how to fix it in Supabase, Firebase and other stacks, and how we flag it.](https://proxymail.qa/solve/localhost-links) - [Common Supabase sign-up and login problemsEmails that never arrive, links that expire or sign nobody in, and sign-ups that fail, with the fix for each.](https://proxymail.qa/solve/supabase-auth-problems) - [Common Firebase sign-up and login problemsMissing verification and reset emails, verified users who still look unverified, failing links and sign-up limits, with the fix for each.](https://proxymail.qa/solve/firebase-auth-problems) - [Sign-up and login problems in vibe-coded appsThe login bugs AI-built apps usually ship with: emails only you receive, links to the preview, missing pages, and what to ask the builder.](https://proxymail.qa/solve/vibe-coded-login-problems) - [Test sign-up emails in PlaywrightA complete Playwright test for sign-up codes and links, from a fresh inbox to the report on the pull request.](https://proxymail.qa/solve/playwright-email-tests) - [Test sign-up emails in CypressA complete Cypress test for sign-up links and codes, with the email waits running as Cypress tasks.](https://proxymail.qa/solve/cypress-email-tests) - [Test sign-up emails with pytestA complete pytest test for sign-up codes and links, with Playwright for Python or Selenium and a one-file helper.](https://proxymail.qa/solve/pytest-email-tests) - [Test coupon codes and welcome offersThe coupon with its discount, end date and arrival time, what checkout did with it, and a failure when an expired or reused one is accepted.](https://proxymail.qa/solve/coupon-code-testing) - [Test unsubscribe links and one-click unsubscribeThe unsubscribe headers and link checked on every marketing email, and a watch that flags any marketing after unsubscribing, with no time limit.](https://proxymail.qa/solve/unsubscribe-testing) - [Test that a welcome offer can't be claimed twiceVersions of one address that reach the same inbox, and a check that fails when the same person got the offer more than once.](https://proxymail.qa/solve/welcome-offer-abuse) [Built your app with an AI tool? Pick yours](https://proxymail.qa/built-with)