# One-Time Passwords Create a passwordless experience using magic links and one-time passwords. > For the index of this section of the site, see [llms.txt](https://fusionauth.io/docs/llms.txt) Available since `1.41.0` One-Time Password (OTP) authentication provides the ability to prove a user identity without a password. To do so, the user enters a unique identifier, and FusionAuth sends a single-use, time-bound code to the user associated with that identifier over a secure communication channel of your choice: ```mermaid flowchart TD FA[FusionAuth] subgraph UserContext[User Context] Channel[secure communication channel] User[User] end User -->|1. Provides unique identifier| FA FA -->|2. Pushes OTP| Channel Channel -->|3. Delivers OTP| User User -->|4. Submits OTP| FA ``` The **unique identifier** could be an email address, username, or phone number. The **secure communication channel** could be an email, text message, or any other service you connect using a [Messenger](https://fusionauth.io/docs/customize/email-and-messages/messengers.md), like Slack or Whatsapp. ## Work with Magic Links and Codes [Configure Set up a passwordless experience using magic links and codes.](https://fusionauth.io/docs/lifecycle/authenticate-users/one-time-passwords/configure.md) [Customize Customize the one-time password experience in your application.](https://fusionauth.io/docs/lifecycle/authenticate-users/one-time-passwords/customize.md) ## Disambiguation One-Time Passwords are sometimes referred to as **Passwordless** or **Magic Link (and Code)** authentication. This commonly creates confusion with other authentication concepts, including: * [Passkeys](https://fusionauth.io/docs/lifecycle/authenticate-users/passkeys.md): frequently called **Passwordless** authentication, distinct from one-time passwords because passkeys are built upon the WebAuthn standard for public/private key exchange in lieu of a password (whereas one-time passwords are, ultimately, still passwords). * [Multi-Factor Authentication (MFA, sometimes referred to as 2FA)](https://fusionauth.io/docs/lifecycle/authenticate-users/multi-factor-authentication.md): often uses the term **TOTP** (Time-based One-Time Password), easily confused with OTP (One-Time Password). While TOTP and OTP are quite similar (in fact, OTP is also time-constrained), MFA TOTPs are a *secondary* form of authentication, not a primary form like one-time passwords. You *can* authenticate with *only* a one-time password, but you *cannot* authenticate with *only* a MFA TOTP. ## Strategies When you use One-Time Passwords for authentication, you must choose a **strategy**: | Strategy name | Form | Usage | | --- | --- | --- | | Clickable link | a **magic link** that the user clicks to visit and authenticate with your application | popular for email authentication, when users access their email account and your application on the same device. | | Form field | a **magic code** that the user copies and pastes (or memorizes and types) | preferred for phone-based authentication, where the user might use your application on a device other than their phone. | ## When Should I Use Magic Links? Magic link authentication eases a user's sign-in experience. Instead of remembering a password, the user provides their email address or phone number, then FusionAuth sends a one-time password. The user authenticate by clicking the link or submitting the code on the login page. In addition to being easier for users, a one-time password login experience prevents them from reusing the same password across different sites or applications. No longer will you worry about another website's data breach causing illicit access to your system. In addition, password brute forcing is no longer a threat since one-time passwords are only created upon request and only valid for a short, configurable time. ## Security With one-time password authentication, if the user's email account or phone number is hijacked, their account on your system is compromised. However, many organizations have security policies and protections around email accounts. It is often easier to protect and regularly change one email account password than to change all of a user's passwords. Email accounts are also more likely to have two-factor authentication enabled. One way to increase the security of your one-time passwords is to decrease the lifetime of the code. This will help if the secure message is compromised or accidentally forwarded. There are no limits on how many passwordless requests can be made for a user, but only the most recent code is valid. Using any of the others, even if they have not yet expired, will display an `Invalid login credentials` message to the user. If someone tries to log in with a unique identifier that is not present in the FusionAuth user database, they'll see the same notification as they would if the email or phone number existed. No email or SMS message will be sent. If you use the passwordless API, follow the principle of least privilege, and limit calls to which the API key has access. If you are using the API key only for one-time password login, don't give this key any other permissions. ### Disable Passwords You can choose to disable passwords to enforce passwordless login. See the [Password enabled](https://fusionauth.io/docs/get-started/core-concepts/types/tenants.md#password-settings) tenant setting for more information. ## Troubleshooting ### Magic Link Button Does Not Appear on Login Page If the Login with a magic link button does not appear on your login page, check the following: * Ensure that the application has **Passwordless Login** enabled under the Security tab. * Ensure that the application and tenant have a valid email or phone template configured for Passwordless Login. * Ensure that SMS or email is configured in the tenant settings. ### Email If you are experiencing troubles with email delivery, review [the email troubleshooting documentation](https://fusionauth.io/docs/operate/troubleshooting.md#troubleshooting-email). ### Invalid Links In some cases, email clients will visit links in an email before the user does. In particular, this is known to happen with Outlook "safe links". If the client does this when the email contains a passwordless one time code, that code may be invalid when the user clicks on it, as it has already been visited. One option is to consult with your email client administrator. It may be possible to add the application's URL to an allow list. In version `1.27.0`, FusionAuth changed the link processing behavior to remedy this for some situations. Given the wide variety of email client behavior, it may still be present in other scenarios. If your users' passwordless codes are being expired by an email client, please [file a GitHub issue](https://github.com/FusionAuth/fusionauth-issues/issues). --- ## Other pages in Authenticate Users > For the full index of this section, see [Lifecycle](https://fusionauth.io/docs/llms-lifecycle.txt). - [Application Authentication Tokens](https://fusionauth.io/docs/lifecycle/authenticate-users/application-authentication-tokens.md): Leverage Application specific authentication tokens to speed up certain authentication tasks. - [Contextual Multi-Factor Authentication (MFA)](https://fusionauth.io/docs/lifecycle/authenticate-users/contextual-multi-factor.md): Learn about how FusionAuth decides to trigger multi-factor authentication (MFA) in the login flow. - [Add a SAML v2 with ADFS IdP](https://fusionauth.io/docs/lifecycle/authenticate-users/identity-providers/enterprise/adfs.md): Configure SAML v2 for Active Directory Federation Services (ADFS). - [Add an OpenID Connect with Azure AD IdP](https://fusionauth.io/docs/lifecycle/authenticate-users/identity-providers/enterprise/azure-ad-oidc.md): Set up user login using Azure AD/Microsoft Entra ID as an OpenID Connect Identity Provider. - [Add a SAML v2 with Azure AD IdP](https://fusionauth.io/docs/lifecycle/authenticate-users/identity-providers/enterprise/azure-ad-saml.md): Configure SAML v2 for Azure Active Directory (Azure AD)/Microsoft Entra ID. - [Add a OpenID Connect with Cognito IdP](https://fusionauth.io/docs/lifecycle/authenticate-users/identity-providers/enterprise/cognito.md): Set up user login using Cognito as an OpenID Connect Identity Provider. - [Add a HYPR IdP](https://fusionauth.io/docs/lifecycle/authenticate-users/identity-providers/enterprise/hypr.md): Set up user login with HYPR using the HYPR Identity Provider. - [Add an OpenID Connect with Okta IdP](https://fusionauth.io/docs/lifecycle/authenticate-users/identity-providers/enterprise/okta-oidc.md): Learn how to set up user login using Okta as an OpenID Connect Identity Provider. - [Add a SAML v2 IdP-Initiated with Okta IdP](https://fusionauth.io/docs/lifecycle/authenticate-users/identity-providers/enterprise/okta-samlv2-idp-initiated.md): Configure SAML v2 IdP-Initiated SSO With Okta. - [Add a SAML v2 with Okta IdP](https://fusionauth.io/docs/lifecycle/authenticate-users/identity-providers/enterprise/okta-samlv2.md): Configure SAML v2 for Okta. - [Add a SAML v2 IdP-Initiated IdP](https://fusionauth.io/docs/lifecycle/authenticate-users/identity-providers/enterprise/samlv2-idp-initiated.md): Set up user login using a SAML v2 IdP-Initiated Identity Provider. - [External JWT IdP Example Usage](https://fusionauth.io/docs/lifecycle/authenticate-users/identity-providers/external-jwt/example.md): Learn how to federate identity using the External JWT Identity Provider. - [Add an External JWT IdP](https://fusionauth.io/docs/lifecycle/authenticate-users/identity-providers/external-jwt.md): Complete a FusionAuth login with an external JWT from a third party Identity Provider. - [Add an OpenID Connect with Discord IdP](https://fusionauth.io/docs/lifecycle/authenticate-users/identity-providers/gaming/discord.md): Learn how to set up user log in using Discord as an OpenID Connect Identity Provider. - [Add an Epic Games IdP](https://fusionauth.io/docs/lifecycle/authenticate-users/identity-providers/gaming/epic-games.md): Learn more about user login with Epic Games using the Epic Games Identity Provider. - [Add a Nintendo IdP](https://fusionauth.io/docs/lifecycle/authenticate-users/identity-providers/gaming/nintendo.md): Learn more about user login with Nintendo using the Nintendo Identity Provider. - [Add a Sony PlayStation Network IdP](https://fusionauth.io/docs/lifecycle/authenticate-users/identity-providers/gaming/sony.md): Learn more about user login with Sony PlayStation using the Sony PlayStation Identity Provider. - [Add a Steam IdP](https://fusionauth.io/docs/lifecycle/authenticate-users/identity-providers/gaming/steam.md): Learn more about user login with Steam using the Steam Identity Provider. - [Add a Twitch IdP](https://fusionauth.io/docs/lifecycle/authenticate-users/identity-providers/gaming/twitch.md): Learn more about user login with Twitch using the Twitch Identity Provider. - [Add an Xbox IdP](https://fusionauth.io/docs/lifecycle/authenticate-users/identity-providers/gaming/xbox.md): Learn more about user login with Xbox using the Xbox Identity Provider. - [Add an Identity Provider (IdP)](https://fusionauth.io/docs/lifecycle/authenticate-users/identity-providers.md): An overview of all FusionAuth Identity Providers, which allow authentication delegation. - [Add an OpenID Connect IdP](https://fusionauth.io/docs/lifecycle/authenticate-users/identity-providers/overview-oidc.md): Learn more about user login using an OpenID Connect Identity Provider. - [Add an External SAML v2 IdP](https://fusionauth.io/docs/lifecycle/authenticate-users/identity-providers/overview-samlv2.md): Learn how to set up user log in using the SAML v2 Identity Provider. - [Add an Apple IdP](https://fusionauth.io/docs/lifecycle/authenticate-users/identity-providers/social/apple.md): Learn how to add a login with Apple button to your application. - [Add a Facebook IdP](https://fusionauth.io/docs/lifecycle/authenticate-users/identity-providers/social/facebook.md): Learn how to add a login with Facebook button to your application. - [Add a Github IdP](https://fusionauth.io/docs/lifecycle/authenticate-users/identity-providers/social/github.md): Set up user login using Github as an OpenID Connect Identity Provider. - [Add a Google IdP](https://fusionauth.io/docs/lifecycle/authenticate-users/identity-providers/social/google.md): Learn how to add a login with Google button to your application. - [Add a LinkedIn IdP](https://fusionauth.io/docs/lifecycle/authenticate-users/identity-providers/social/linkedin.md): Learn how to add a login with LinkedIn button to your application. - [Add a Twitter/X IdP](https://fusionauth.io/docs/lifecycle/authenticate-users/identity-providers/social/twitter.md): Learn how to add a login with Twitter/X button to your application. - [OIDC & CockroachDB](https://fusionauth.io/docs/lifecycle/authenticate-users/integrations/oidc/cockroachdb.md): Learn how to set up CockroachDB to allow users to log in using FusionAuth via OIDC. - [OpenID Connect Integrations](https://fusionauth.io/docs/lifecycle/authenticate-users/integrations/oidc.md): Examples of OIDC integrations. - [OIDC & Salesforce](https://fusionauth.io/docs/lifecycle/authenticate-users/integrations/oidc/salesforce.md): Learn how to set up Salesforce to allow users to log in using FusionAuth via OIDC. - [OIDC & Tableau Cloud](https://fusionauth.io/docs/lifecycle/authenticate-users/integrations/oidc/tableau.md): Learn how to set up Tableau Cloud to allow users to log in using FusionAuth via OIDC. - [SAML v2 & Aiven](https://fusionauth.io/docs/lifecycle/authenticate-users/integrations/saml/aiven.md): Setting up Aiven to allow users to log in using FusionAuth via SAML v2. - [SAML v2 & Google](https://fusionauth.io/docs/lifecycle/authenticate-users/integrations/saml/google.md): Setting up Google to allow users to log in using FusionAuth via SAML v2. - [SAML](https://fusionauth.io/docs/lifecycle/authenticate-users/integrations/saml.md): Examples of SAMLv2 integrations. - [SAML v2 & PagerDuty](https://fusionauth.io/docs/lifecycle/authenticate-users/integrations/saml/pagerduty.md): Setting up PagerDuty to allow users to log in using FusionAuth via SAML v2. - [SAML v2 & SendGrid](https://fusionauth.io/docs/lifecycle/authenticate-users/integrations/saml/sendgrid.md): Setting up SendGrid to allow users to log in using FusionAuth via SAML v2. - [SAML v2 & Tableau Cloud](https://fusionauth.io/docs/lifecycle/authenticate-users/integrations/saml/tableau-cloud.md): Setting up Tableau Cloud to allow users to log in using FusionAuth via SAML v2. - [SAML v2 & Zendesk](https://fusionauth.io/docs/lifecycle/authenticate-users/integrations/saml/zendesk.md): Setting up Zendesk to allow users to log in using FusionAuth via SAML v2. - [Build a Login Page with the Login API](https://fusionauth.io/docs/lifecycle/authenticate-users/login-api.md): Learn about the Login API and when you would use it. - [JSON Web Tokens](https://fusionauth.io/docs/lifecycle/authenticate-users/login-api/json-web-tokens.md): Learn how FusionAuth provides and manages JSON Web Tokens. - [Logout And Session Management](https://fusionauth.io/docs/lifecycle/authenticate-users/logout-session-management.md): Learn about how FusionAuth handles logout and session management. - [Multi-Factor Authentication (MFA)](https://fusionauth.io/docs/lifecycle/authenticate-users/multi-factor-authentication.md): Learn about how to use multi-factor authentication (MFA) in FusionAuth as a developer. - [OAuth DPoP](https://fusionauth.io/docs/lifecycle/authenticate-users/oauth/dpop.md): Learn how to enable sender-constrained OAuth tokens DPoP (Demonstration of Proof-of-Possession) with FusionAuth and validate DPoP proofs in your APIs. - [OAuth](https://fusionauth.io/docs/lifecycle/authenticate-users/oauth.md): An overview of how FusionAuth provides an OAuth 2.0 and OpenID Connect SSO login system. - [OAuth Issuer Validation](https://fusionauth.io/docs/lifecycle/authenticate-users/oauth/issuer-validation.md): Learn how to validate the authorization response issuer parameter (RFC 9207) to prevent mix-up attacks. - [Modes](https://fusionauth.io/docs/lifecycle/authenticate-users/oauth/modes.md): An overview of OAuth modes and how OAuth is commonly used. - [OIDC Prompt](https://fusionauth.io/docs/lifecycle/authenticate-users/oauth/prompt.md): Learn about OpenID Connect prompt and example use cases. - [OAuth Response Modes](https://fusionauth.io/docs/lifecycle/authenticate-users/oauth/response-modes.md): Learn about OAuth 2.0 response modes (query, fragment, form_post) and when to use each one. - [Access Control with OAuth Scopes](https://fusionauth.io/docs/lifecycle/authenticate-users/oauth/scopes.md): Learn about OAuth scope policy configuration, managing custom scopes, and using scopes in an OAuth2 workflow. - [Manage Software Tokens](https://fusionauth.io/docs/lifecycle/authenticate-users/oauth/tokens.md): Learn about OAuth2 and OpenID Connect Tokens and how they are used. - [URL Validation](https://fusionauth.io/docs/lifecycle/authenticate-users/oauth/url-validation.md): Learn about OAuth URL validation policies in FusionAuth. - [Configure One-Time Passwords](https://fusionauth.io/docs/lifecycle/authenticate-users/one-time-passwords/configure.md): Set up a passwordless experience using magic links and codes. - [Customize One-Time Passwords](https://fusionauth.io/docs/lifecycle/authenticate-users/one-time-passwords/customize.md): Customize the one-time password experience in your application. - [Configure Passkeys](https://fusionauth.io/docs/lifecycle/authenticate-users/passkeys/configure.md): Set up a passwordless experience using passkeys. - [Customize Passkeys](https://fusionauth.io/docs/lifecycle/authenticate-users/passkeys/customize.md): Customize the passkey experience in your application. - [Passkeys](https://fusionauth.io/docs/lifecycle/authenticate-users/passkeys.md): An overview of the passwordless capabilities of FusionAuth. - [Risk Signals](https://fusionauth.io/docs/lifecycle/authenticate-users/risk-signals.md): Learn about the risk signals that FusionAuth uses to identify suspicious activity and influence intelligent MFA decisionmaking. - [Host a SAML v2 Identity Provider](https://fusionauth.io/docs/lifecycle/authenticate-users/saml.md): An overview of the SAML Identity Provider capabilities of FusionAuth. - [Setting Up User Account Lockout](https://fusionauth.io/docs/lifecycle/authenticate-users/setting-up-user-account-lockout.md): Learn how to set up user account locking rules. - [Implementing Single Sign-on](https://fusionauth.io/docs/lifecycle/authenticate-users/single-sign-on.md): Learn how to implement single sign-on between applications using FusionAuth.