Bird
Raised Fist0
Supabasecloud~20 mins

Magic link authentication in Supabase - Practice Problems & Coding Challenges

Choose your learning style10 modes available
LearnWhyDeepVisualTryChallengeProjectRecallTime
Challenge - 5 Problems
🎖️
Magic Link Master
Get all challenges correct to earn this badge!
Test your skills under time pressure!
❓ service_behavior
intermediate
2:00remaining
Magic Link Email Behavior

When a user requests a magic link for authentication in Supabase, what happens immediately after the request is made?

AThe user receives an email with a permanent link that can be used multiple times.
BThe user receives an email with a link that expires after a short time and can be used only once.
CThe user is logged in instantly without any email sent.
DThe user receives a text message with a code instead of an email.
Attempts:
2 left
💡 Hint

Think about security and temporary access.

❓ Configuration
intermediate
2:00remaining
Configuring Magic Link Expiry

Which Supabase configuration setting controls how long a magic link remains valid before expiring?

Aauth.email.link_lifetime
Bauth.magic_link.expiration_time
Cauth.email.link_expiry
Dauth.email.confirmation_expiry
Attempts:
2 left
💡 Hint

Look for a setting related to email confirmation expiry.

❓ security
advanced
2:00remaining
Preventing Replay Attacks with Magic Links

Which practice best prevents replay attacks when using magic link authentication in Supabase?

AInvalidate the magic link immediately after the first successful use.
BUse a static magic link URL for all users.
CSend the magic link over unsecured HTTP to speed up delivery.
DAllow magic links to be used multiple times within their expiry period.
Attempts:
2 left
💡 Hint

Think about what happens after the link is used once.

❓ Architecture
advanced
2:00remaining
Magic Link Authentication Flow

What is the correct order of steps in the magic link authentication process in Supabase?

A1,2,3,4
B2,1,3,4
C1,3,2,4
D3,1,2,4
Attempts:
2 left
💡 Hint

Think about the natural sequence from request to login.

✅ Best Practice
expert
2:00remaining
Handling Expired Magic Links

What is the best way to handle a user clicking an expired magic link in a Supabase application?

AAutomatically log the user in anyway to avoid frustration.
BRedirect the user to the homepage without explanation.
CShow an error message and provide an option to request a new magic link.
DDelete the user's account to prevent security risks.
Attempts:
2 left
💡 Hint

Consider user experience and security.

Practice

(1/5)
1. What is the main purpose of magic link authentication in Supabase?
easy
A. Authenticate users using biometric data like fingerprints
B. Require users to enter a password and a code sent via SMS
C. Use social media accounts for login
D. Allow users to log in by clicking a link sent to their email without using a password

Solution

  1. Step 1: Understand magic link authentication

    Magic link authentication lets users log in by clicking a special link sent to their email, avoiding passwords.

  2. Step 2: Compare options with this definition

    Only Allow users to log in by clicking a link sent to their email without using a password describes login via email link without passwords, matching the magic link concept.

  3. Final Answer:

    Allow users to log in by clicking a link sent to their email without using a password -> Option D

  4. Quick Check:

    Magic link = login via email link without password [OK]
Hint: Magic link means login by email link, no password needed [OK]
Common Mistakes:
  • Confusing magic link with password or biometric login
  • Thinking magic link requires SMS codes
  • Assuming social login is magic link
2. Which is the correct way to call Supabase's magic link sign-in method in JavaScript?
easy
A. supabase.auth.signInWithPassword({ email: 'user@example.com' })
B. supabase.auth.signInWithOtp({ email: 'user@example.com' })
C. supabase.auth.signInWithMagicLink('user@example.com')
D. supabase.auth.loginWithOtp('user@example.com')

Solution

  1. Step 1: Recall Supabase magic link method name

    The correct method is signInWithOtp with an object containing the email.

  2. Step 2: Match method and parameter format

    supabase.auth.signInWithOtp({ email: 'user@example.com' }) uses signInWithOtp with an object { email: '...' }, which is correct syntax.

  3. Final Answer:

    supabase.auth.signInWithOtp({ email: 'user@example.com' }) -> Option B

  4. Quick Check:

    Method name and parameter object = supabase.auth.signInWithOtp({ email: 'user@example.com' }) [OK]
Hint: Use signInWithOtp with email in an object [OK]
Common Mistakes:
  • Using wrong method names like signInWithPassword
  • Passing email as a string instead of an object
  • Confusing method names with social login
3. What will the following code do?
const { data, error } = await supabase.auth.signInWithOtp({ email: 'test@example.com' });
console.log(data);
console.log(error);
medium
A. Send a magic link to 'test@example.com' and log data with confirmation info, error null
B. Return error because email format is invalid
C. Throw a syntax error because signInWithOtp requires a password
D. Send a magic link to 'test@example.com' and log data with user info, error null

Solution

  1. Step 1: Understand signInWithOtp behavior

    This method sends a magic link to the email and returns data about the request, not user info immediately.

  2. Step 2: Analyze console output

    Data contains confirmation info about sending the link; error is null if successful. No syntax error or invalid email here.

  3. Final Answer:

    Send a magic link to 'test@example.com' and log data with confirmation info, error null -> Option A

  4. Quick Check:

    signInWithOtp sends link, returns confirmation data [OK]
Hint: signInWithOtp returns confirmation data, not user info [OK]
Common Mistakes:
  • Expecting immediate user info in data
  • Thinking password is required
  • Assuming invalid email error for valid format
4. You wrote this code but users report they never receive magic links:
await supabase.auth.signInWithOtp('user@example.com');

What is the problem?
medium
A. The method name is incorrect, should be signInWithMagicLink
B. Magic links require a password parameter
C. The email should be passed inside an object, not as a string
D. You must call a separate sendMagicLink function after signInWithOtp

Solution

  1. Step 1: Check method parameter format

    signInWithOtp expects an object with an email property, not a plain string.

  2. Step 2: Identify why magic link is not sent

    Passing a string causes the method to fail silently or not send the email, so users get no link.

  3. Final Answer:

    The email should be passed inside an object, not as a string -> Option C

  4. Quick Check:

    Email must be in object for signInWithOtp [OK]
Hint: Pass email as { email: '...' }, not just a string [OK]
Common Mistakes:
  • Passing email as string instead of object
  • Thinking password is needed for magic link
  • Using wrong method names
5. You want to implement magic link login but only allow users with emails from 'example.com'. Which approach is best?
hard
A. Before calling signInWithOtp, check if email ends with '@example.com' and reject others
B. Call signInWithOtp for all emails, then filter users after login
C. Use signInWithOtp and set a password for domain restriction
D. Configure Supabase to block all emails except 'example.com' automatically

Solution

  1. Step 1: Understand domain restriction needs

    To restrict login to a domain, validate the email before sending magic link.

  2. Step 2: Choose best practice

    Checking email domain in your app before calling signInWithOtp prevents sending links to unauthorized users.

  3. Final Answer:

    Before calling signInWithOtp, check if email ends with '@example.com' and reject others -> Option A

  4. Quick Check:

    Pre-check email domain before magic link send [OK]
Hint: Validate email domain before sending magic link [OK]
Common Mistakes:
  • Sending magic links to all emails then filtering
  • Thinking password is needed for domain restriction
  • Assuming Supabase blocks domains automatically
Recommended

Ready to prove it?

Pass the test and this pattern moves unknown strong while earning +1 Grip toward your certificate.

10 questions~5 mineasy hard