Can passwordless login code TTL be configured per application instead of per tenant?

[FASupportBot]

We need different passwordless login code expiration times for different applications within the same tenant. Currently, tenant.externalIdentifierConfiguration.passwordlessLoginTimeToLiveInSeconds is a tenant-level setting that applies globally to all applications in that tenant.

Is there a way to configure the passwordless code time-to-live (TTL) on a per-application basis rather than per-tenant?

[FASupportBot]

Unfortunately, the passwordless login code TTL cannot be configured per application—it is only available as a tenant-level setting in FusionAuth. The default TTL is 180 seconds, and this is configured via tenant.externalIdentifierConfiguration.passwordlessLoginTimeToLiveInSeconds.

Here are two potential workarounds:

1. Separate Tenants

Since the setting is per tenant, you could place applications that require different code lifetimes into separate tenants. Note that this means users and configuration will be isolated per tenant, so carefully evaluate whether this trade-off fits your architecture.

2. Build Your Own Passwordless Flow

You can implement custom code expiration logic by using the passwordless API directly:

• Start the login with /api/passwordless/start
• Deliver the code through your own mechanism
• Track when you issued each code in your application
• Enforce your desired per-application expiry by rejecting codes that are too old before calling the completion endpoint
• Complete the login with /api/passwordless/login

With this approach, the tenant-level TTL acts as the maximum lifetime, but your application logic can enforce shorter, application-specific expirations as needed.

This is not a built-in FusionAuth feature, so if per-application passwordless code TTL is important to your use case, consider submitting a feature request on the FusionAuth GitHub issues page.

---

Related Documentation

• Passwordless Login Overview - General overview of passwordless authentication in FusionAuth
• Magic Links Guide - Details on magic links and one-time code customization, including TTL configuration
• Passwordless API - Complete API reference for building custom passwordless flows
• Start Passwordless Login API - API to generate a passwordless code
• Complete Passwordless Login API - API to complete the passwordless login
• Tenant Configuration - Tenant-level external identifier settings including passwordless login TTL