# How to test a magic-link login flow

Break magic-link testing into the request form, email delivery, token handling and authenticated app state. Each part needs its own evidence.

## Why it is hard

- The test needs a fresh token with a known lifetime.
- Inbox retrieval is separate from browser interaction.
- A used or expired link can make a test fail for the wrong reason.

## Plan the test around an observable outcome

1. Use a dedicated email test harness to capture the intended message.
2. Verify expiry and one-time use at the authentication layer.
3. Test the request form and its browser-visible confirmation.
4. Prepare an authenticated test account for downstream app behavior.

## Where Zerocheck fits

1. Use Zerocheck for supported browser form validation and visible confirmations.
2. Configure a supported test-account login path for authenticated app tests.
3. Keep email retrieval, token extraction and clicking inbox links in another harness.

## Split the handoff deliberately

The request form can show the right state while delivery fails. The email can arrive while its token is unusable. Keeping these assertions separate makes the failure actionable: the browser test covers the form, and the email or authentication test covers the handoff.

## Current Zerocheck scope

Email, SMS and magic-link-in-email steps are unsupported. If your only login path requires an inbox interaction, resolve that setup constraint during the evaluation before expecting an authenticated browser suite to run.

## Pitfalls

- A message on the page does not establish delivery.
- Do not reuse single-use links across tests.
- Do not describe inbox polling as a supported Zerocheck browser step.

## Frequently asked questions

### Can Zerocheck retrieve a login email?

No. Use a separate email harness. Zerocheck does not provide inbox access or magic-link extraction.

### Can it test the app after login?

Yes, when you provide a supported login setup and test account. The browser test then covers the specified app behavior.

Related: [Email Flow Testing Boundaries](https://tryzerocheck.com/use-cases/email-flow-testing/)

---
Canonical: https://tryzerocheck.com/guides/test-magic-links/
Updated: 2026-09-14