As a passwordless authentication method used for security, the Magic Link token sent to a user’s email address should only allow access for a short time period, usually an hour. Organizations set the time period. Similar to a one-time-password, the Magic Link’s access should be deactivated when the period expires.