Magic Link Email Not Working: What to Check First

If your magic link email is not working, do not keep clicking old links or requesting new ones yet. First match the email to the active sign-in attempt: use the newest message from the provider, open it on the same device, browser, and browser profile where you started login, avoid forwarded or shared links, and check whether the destination page says the link expired, was already used, or cannot match the session. If any of those are true, retire the older emails and request one fresh link through the provider's official flow.

Providers decide their own expiry, one-time-use and same-browser rules, and they differ a lot: one widely used login service expires links after an hour by default, another refuses the link if it opens in a different browser from the one that asked for it. What works everywhere is one clean login attempt, without mixing old links, profiles and devices.

Magic-link failure decision tree

Use this before you start over. It separates delivery problems from click-and-handoff problems.

If the link went to an address you do not use any more, or you are not sure which address the account has, find the account's address before you request another link.

1. The link says expired or already used

A magic link can fail simply because it is no longer the link attached to the current login attempt. If you requested more than one email, open the newest official message first and ignore older ones unless the provider tells you otherwise.

How long a link lasts depends on the service. Two login platforms that many sites build on show the range:

• Supabase (default settings): a user can request a magic link once every 60 seconds, links expire after 1 hour, and each link works once.
• Auth0: the request and the click must happen in the same browser, or the sign-in fails. Its documentation calls out iOS, where Mail may open the link in Safari rather than the browser you started in.

A site built on either can change these settings, so treat them as examples of why links behave differently, not as the rule for your site. The message on the page is the authority: if it says expired, invalid, already used or not recognised, that link is finished.

Expired links also fail in unhelpful ways. Some sites show a clear expiry notice, others show a generic error, and some sign you in to a stale attempt that then goes nowhere. Rather than decoding which failure you got, use only the email that arrived after your latest request. And if the link spent ten minutes in Spam or a Gmail tab before you found it, it may have expired before you saw it. Request one more and watch the place where you found the last one.

If a brand-new link says "already used" the instant you click it, especially at a work address, a mail security scanner may have opened it first; see why your email scanner clicks magic links first. If the link opens to a blank white page with no error message at all, the link may still be good; check the blocker and cookie causes of a blank page before you request another.

A clean retry looks like this:

1. Close or ignore older magic-link emails.
2. Return to the provider's sign-in page by typing its address yourself, not from a button in an old email.
3. Start one new login attempt.
4. Wait for the newest email from the official sender.
5. Open that link in the same browser and profile that started the attempt.

2. Check the browser profile, not just the browser name

A magic link may open in Chrome and still be the wrong context. Chrome supports multiple profiles so browser data such as bookmarks, history, passwords, and settings can be separated by profile. Microsoft Edge also supports signing in and creating multiple profiles. That matters when your work login started in one browser profile but your email link opens in another.

Look for profile clues before you click again:

• the profile avatar or name in the top-right of the browser;
• whether the login page is open in a work, personal, client, or test profile;
• whether the email account that received the link belongs to the same profile context;
• whether your password manager or saved account is switching you to a different identity.

If the wrong profile owns the click, the provider may not be able to connect the link with the original browser session. Do not keep trying the same old link from different profiles. Instead, return to the intended profile, start one fresh provider login attempt, and use the newest link there.

3. Opened on the wrong device or in the wrong app

Many failures happen between the inbox and the browser. A phone email app may open links in its own in-app browser or the phone's default browser. Desktop mail apps can hand links to a different default browser from the one where sign-in began.

Decide where the session should live before you open another email. For example: work Chrome profile, on the laptop. Close the sign-in tabs on the phone and in other profiles, start the sign-in once in the browser you chose, and open the newest link there. With one active attempt, the next email is no longer a guess.

Check that the mailbox and the profile match. Which email account receives this service's mail, and can you open that account in the profile where you restarted? If the mail goes to personal Gmail but the session belongs in the work profile, you know in advance that clicking the link from your phone will not complete the login. Open the mail on the same machine and profile instead. The same split happens with codes; see code on your phone, login on your laptop.

Be more careful, not less. While you are recovering, you expect login emails you did not request from this machine, which makes it a good moment for a fake one to work. Only click a link that answers a request you made in the last few minutes, from a sender the service really uses.

Do not paste the link into team chat, a ticket, a shared doc, or another person's browser. A magic link is a login credential for that attempt, not a link to share.

4. Do not forward magic links as a workaround

Forwarding a magic-link email creates two problems at once: it moves a login credential outside the original inbox, and it may open the link in a browser the provider does not recognise. Some providers allow cross-device sign-in and others do not. Do not forward or share magic links; use the provider's own account access or recovery path instead.

If a team process depends on one person receiving login links for everyone, fix that ownership problem after the immediate incident. Use proper account roles, delegated access, or provider-supported team administration where available. Do not normalize shared magic links as an operating procedure.

5. When to request a fresh magic link

Request one fresh link when any of these are true:

• the page says the link expired, was already used, is invalid, or cannot be verified;
• you clicked an older email after requesting a newer one;
• the link opened in the wrong browser, profile, device, or in-app browser;
• you forwarded the link or opened it from a mailbox that is not the account's normal login inbox;
• the provider's official help says to restart the passwordless flow.

Before requesting, clear the confusion: decide which browser/profile/device will own the attempt, return to the provider's sign-in page there, and use only the newest email that arrives after that point. If the next fresh link also fails, stop guessing and use the provider's recovery or support route.

6. How this differs from an OTP code problem

An OTP-code problem is usually about finding and using the newest code. A magic-link problem includes that freshness issue, but it also adds browser handoff, profile state, device state, and link-click side effects. If your provider sent a code instead, use the OTP email checklist when it has not arrived, or the stale-code check when it arrived but the site rejects it.

If the same email carries both a link and a code, use one of them, not both: using one can cancel the other. Which one to use depends on where you are reading the email and where the login started.

If your provider sent a clickable login email, stay with this decision tree. The browser/profile branch is the part most generic "check spam and retry" advice misses.

Where MagicLess fits

For connected Gmail inboxes, MagicLess shows the newest login link for the site you are on, on that site's page, so the link opens in the browser and profile where you started. It cannot make an expired link valid, make a provider accept a different browser, or read inboxes you have not connected, and it never opens a link without your click.

FAQ

Why is my magic link email not working after I click it?

Common causes include using an older email, opening the link after it expired or was already used, clicking from a different browser/device/profile than the active login attempt, or running into a provider-specific passwordless-login rule. Use the newest official email and follow that provider's flow.

Can a magic link fail because it opens the wrong browser or profile?

Yes. Browser profiles can keep separate account state, and official Chrome and Edge help both document multiple profile support. If the login attempt started in one profile but the email opens in another, restart cleanly in the intended profile instead of reusing old links.

Should I forward a magic link to another device or teammate?

No. Do not treat a magic link as a shareable URL. It is part of an authentication flow. Use the provider's supported login, account recovery, delegated access, or team-management features instead.

What should I do if the link expired or says it was already used?

Stop trying older emails. Return to the provider's official login page, start one fresh attempt, and open only the newest link that arrives for that attempt. If it still fails, use the provider's recovery or support path.

Do all magic links have the same expiration time?

No. Each service sets its own. Supabase's default, for example, is 1 hour, and a site can change it. The message on the login page, or the service's own help, gives the rule for that site.

Claim ledger