There's a near-infinite amount of not-so-small gotchas when implementing magic links:

- If magic links are the only way to sign in, authentication success rate is now directly tied to your email deliverability rate.

- Single-use tokens (immediately expiring after clicking) can be followed by spam filters, and thus immediately become invalid for the actual user trying to sign in.

- MTAs using greylisting can cause unexpected delays in email delivery.

- If a session audit trail is implemented, malware scanners following links might cause sessions from unexpected locations showing up.

etc.