MagicLink: get user from token without signing in?

mikesax

I am implementing Ash MagicLink Authentication (registration enabled, require interaction, and single use token) with my custom link confirmation page. If the token is valid it shows a welcome message, otherwise, it redirects to a the sign-in page:

  @impl true
  def mount(%{"token" => token}, _session, socket) do
    if token_valid?(token) do
      {:ok, assign(socket, token: token)}
    else
      {:ok, push_navigate(socket, to: ~p"/start/again")}
    end
  end

  defp token_valid?(token) do
    changeset =
      Welcomepad.Accounts.User
      |> Ash.Changeset.for_create(:sign_in_with_magic_link, %{token: token})

    changeset.valid?
  end

This works great but if the token is valid, I would like to show some different information, depending on the user, in the intro that asks them to push the sign-in button (which then does the POST to do a proper sign-in). For example, if it’s a brand new user, I’d like to show an on-boarding message.

I can’t find an easy way to get the user from a valid magic link token (without actually signing in that user). I guess I could turn off single-use tokens (and destroy the token manually after a sign-in) but that seems like a bit of a hack. Is there a more elegant solution?

5 comments

/ash #ash-authentication-phoenix

0 325 5

2025-08-24 17:36:06 UTC

Showing Posts 1 to 5

Show Best Posts
Show All (oldest first)
Show All (newest first)

ken-kost

But couldn’t you show onboarding screens after login to first time user? i.e. attribute first_login?, :boolean, default: true. and if true you show it and switch it off.

Post #1

mikesax

I want to avoid having a “useless” screen. Technically it’s needed since it requires interaction to trigger the POST, but if it’s just a “Sign In” button, from the user’s perspective it feels like a wasted click. During onboarding, every click matters, so I’d rather show something more engaging. If the first_login? attribute you suggest belongs to the User resource, I’m back to square one: I still need to know which user a valid token belongs to.

Post #2

zachdaniel

Creator of Ash

Assuming you’re hand rolling the page, my suggestion would be to add fields to the sign in with magic link action and then use an after action hook. So there would be new fields alongside the sign in button.

Post #3

mikesax

Yes, I’m hand rolling the page. But wouldn’t those new fields only be available after the sign in? I want to show different info after the user taps the magic link but before they press the button that does a POST to the form.

For now, I have solved it by sending two different emails, with to slightly different links, depending on whether the email is a brand new or belongs to an already onboarded user. In the router, the different URLs point to the same page but with a different action:

live "/signin/t/:token", AuthLive.Confirm, :signin
live "/signup/t/:token", AuthLive.Confirm, :singup

This way, in the HTML I can simply check @live_action and either show a fancy onboarding welcome screen, or a simple “Open MyApp” button.

Thanks for your help!

Post #4

zachdaniel

Creator of Ash

The sign in like create/sign in happens when you press that button. The user is created when they click “sign in”, so it sounds like what you did is pretty much exactly what I was suggesting I think.

Post #5

— All posts loaded —