Passwordless auth with Strapi v5

#coding

#auth

Welcome to the markkët developer blog! Today we're sharing why we decided to implement passwordless auth, and how easy it was with Strapi v5, including a pull request with code samples.

Why passwordless

Sending a magic link to users is safer and removes friction for users. Is a popular technique shared by many startups.

Our previous registration flow required too many steps and it doesn't offer any advantage for users to try and memorize a password, or risk their account data with a predictable string.

Flow

We found a plugin approved by Strapi, but it didn't work for us using Strapi v5. Additionally we want to customize our emails and ensure they're branded.

The process requires building two new endpoints, and having a content schema to store the magic codes. We created a new folder in the `api` called magic codes.

Clients

The clients need a couple of screen, one form that sends a POST request to request the email.

The email must direct to a client screen that trades the code for a JWT token, and sends a welcome email.

Pitfalls & Todo

There are some missing features we need to add in the future, and that you might have to lookout for as well.

Users might change their emails and need to confirm that the new one is associated with the previous data
Clients running in a different domain need to customize the domain in the email