Show HN: MagicSquared – Magic Magic Link Authentication

But I see you are using RS256 and that makes me think of a security issue. Since you are the only one having the private part of the key pair, you could (in the future) log in as any user on any website that uses magicsquared.net since you can generate properly signed JWTs with any possible content.

I understand that this allows for less friction (and thus, more magic) but I think it is a serious problem in case of a breach or malicious intent.

Does anyone know of a way to solve this in a more secure way without adding too much friction?

We built an in-house solution for this and the biggest issue was bots opening the link. You will be surprised by the number of bots / email providers opening your links. Sometimes after just a few minutes, sometimes hours later. So even with a short expiration, there’re still cases where bots are faster than humans.

We had to implement a crappy algorithm to detect if a request is authentic. So far it works and no complaints from customers yet.