> ## Documentation Index
> Fetch the complete documentation index at: https://docs.scute.io/llms.txt
> Use this file to discover all available pages before exploring further.

# Authenticate with magic link

> Authenticate a magic link token and return session tokens. This endpoint validates the magic link token and creates a new session for the user.



## OpenAPI

````yaml /swagger.json patch /v1/auth/{app_id}/magic_links/authenticate
openapi: 3.0.1
info:
  title: Scute API
  version: v1
  description: API for managing users in Scute applications
servers:
  - url: https://{defaultHost}
    variables:
      defaultHost:
        default: api.scute.io
  - url: http://localhost:3333
    description: Development server
security:
  - apiSecret: []
    userAccess: []
paths:
  /v1/auth/{app_id}/magic_links/authenticate:
    parameters:
      - name: app_id
        in: path
        required: true
        description: App ID
        schema:
          type: string
    patch:
      tags:
        - Magic Links
      summary: Authenticate with magic link
      description: >-
        Authenticate a magic link token and return session tokens. This endpoint
        validates the magic link token and creates a new session for the user.
      operationId: authenticateMagicLink
      parameters: []
      responses:
        '200':
          description: successful authentication
          content:
            application/json:
              schema:
                type: object
                properties:
                  access:
                    type: string
                    description: JWT access token
                  refresh:
                    type: string
                    description: JWT refresh token
                  csrf:
                    type: string
                    description: CSRF token for protected operations
                  access_expires_at:
                    type: string
                    format: date-time
                    description: Access token expiration timestamp
                  refresh_expires_at:
                    type: string
                    format: date-time
                    description: Refresh token expiration timestamp
                  user_id:
                    type: string
                    description: App user ID
                  key_id:
                    type: string
                    description: App key ID for JWT verification
        '202':
          description: verification required
          content:
            application/json:
              schema:
                type: object
                properties:
                  verification_required:
                    type: boolean
                    example: true
                  reason:
                    type: string
                    example: security_verification
                  threats:
                    type: array
                    items:
                      type: string
                    description: Detected security threats
        '403':
          description: login blocked
          content:
            application/json:
              schema:
                type: object
                properties:
                  error:
                    type: string
                    example: Login blocked for security reasons
                  error_code:
                    type: string
                    example: security_block
        '404':
          description: magic link not found or expired
          content:
            application/json:
              schema:
                type: object
                properties:
                  error:
                    type: string
                    example: Magic link not found or expired
                  error_code:
                    type: string
                    example: magic_link_not_found_or_expired
components:
  securitySchemes:
    apiSecret:
      type: http
      scheme: bearer
      bearerFormat: JWT
      description: API Secret token
    userAccess:
      type: apiKey
      name: X-Authorization
      in: header
      description: User Access token

````