How to test magic-link login end to end

How BlinkInbox finds the link

Every incoming message is scanned for links. Links whose URL or button text look like sign-in, verify, confirm or reset actions are marked as verification links, and unsubscribe, privacy and social links are ignored. The best match is returned as verificationLink, and the full list is in links.

For an email with only a link and no code, the /otp endpoint returns otp: null and the link filled in, so the same call works for both kinds of email.

GET /inboxes/{id}/otp?timeout=30

{
  "otp": null,
  "verificationLink": "https://app.example.com/auth/magic?token=…",
  "from": "login@example.com",
  "subject": "Sign in to Example"
}

Playwright

test("magic-link sign-in", async ({ page, request }) => {
  const inbox = await (await request.post(`${API}/inboxes`, { headers, data: { prefix: "magic" } })).json();

  await page.goto("/login");
  await page.getByLabel("Email").fill(inbox.address);
  await page.getByRole("button", { name: "Email me a link" }).click();

  const { verificationLink } = await (await request.get(
    `${API}/inboxes/${inbox.id}/otp?timeout=30`, { headers }
  )).json();

  await page.goto(verificationLink);
  await expect(page.getByText("Signed in")).toBeVisible();
});

Things worth asserting

• The link points at the right environment (staging links in staging emails, not production).
• Opening the link twice fails the second time, if your links are meant to be single-use.
• An expired link shows a helpful error. Wait past the expiry, or shorten it in your test configuration.
• The email’s sender and subject are what you expect: from and subject are in the same response.

Questions

More guides

• How to test email verification in Playwright
• How to test sign-up emails in Cypress
• How to give Claude, Cursor or VS Code an email inbox