---
title: "Verify a magic sign-in link cannot be reused"
description: "Check a passwordless email link from a test inbox, then attempt reuse after logout to verify consumption and correct account binding."
canonical_url: "https://vostride.com/agent-library/authentication/magic-link-single-use.md"
md_url: "https://vostride.com/agent-library/authentication/magic-link-single-use.md"
content_kind: "recipe"
topic: "authentication"
---

# Verify a magic sign-in link cannot be reused

Check a passwordless email link from a test inbox, then attempt reuse after logout to verify consumption and correct account binding.

## Risk

A passwordless link is a credential. A first successful click is only half the contract: the application must bind it to the intended account and enforce its documented single-use rule when the same URL is opened again.

## Fixtures

- A test-owned passwordless account with a dedicated test inbox.
- An inbox hook that selects the newest message for this run without printing the link into general logs.
- A product contract that magic links are single-use and an independent sign-in event inspection hook.

## Steps

1. Request a magic link for the fixture address and verify the screen displays the expected nonsecret delivery confirmation.
2. Retrieve the run-specific message through the test inbox fixture and open its sign-in link; verify the account menu shows the intended account.
3. Open a private account page and verify its unique fixture content, then sign out and verify the signed-out state.
4. Reopen the exact consumed link in the signed-out browser and verify the expired-or-used message with no private account content.
5. Request a new link, verify the new message belongs to this run, and confirm it can still sign in normally.

## Expected results

- The initial link grants access only to its intended account.
- Reuse after sign-out does not create another authenticated session.
- The sign-in event hook records the permitted completion and the documented rejected reuse without disclosing token values.

## False-pass traps

- Opening the old link while already signed in can produce a dashboard without proving reuse is permitted.
- Selecting an older inbox message can turn a delivery problem into a misleading token-expiry failure.

## Cleanup

- Sign out, delete run-specific inbox messages, and revoke remaining unused fixture links.

## Use with agent-qa

Adapt this test design to your application's acceptance criteria and configured target using the [recipe execution guide](/agent-library/software-factory/turn-a-recipe-into-an-agent-qa-test.md). External fixture setup and non-UI checks require your own supported hooks or test tooling. Validate the authored test, execute it, and inspect the completed evidence; this recipe is not a recorded test result.

## References

- [agent-qa test](/docs/agent-qa/configuration/test.md)
- [agent-qa hooks](/docs/agent-qa/guides/hooks.md)
- [agent-qa auth state](/docs/agent-qa/guides/auth-state.md)

- [Authentication QA recipes](/agent-library/authentication.md)
- [Software factory QA library](/agent-library.md)