Articles on: Settings & configurations

Personal auto-login links (REST API)

Personal auto-login links are login links for a secured Maglr project that your own application requests through the Maglr REST API. Your application requests a separate link for each user, and each link stops working after the number of hours your application sets.


Note: this option is only available in combination with a Maglr Enterprise license. Contact support for more information.



A project secured with an auto-login link can be opened in two ways:


  • Standard auto-login link: the standard link comes from the Maglr dashboard. There is one link per project, and it never expires. Anyone who has the link can open the project, so a leaked link keeps giving access.
  • Personal auto-login link: your application requests a new link through the REST API for each user. Each link gives access to one project and expires after the number of hours your application sets (24 hours by default). Once a link has expired, it no longer gives access, so a lost or leaked link is only usable until its expiry time.


Personal auto-login links work only for projects secured at project level. A domain secured with an auto-login link uses its own fixed link and doesn't accept personal links.



To set up personal auto-login links for a project:


  1. In the Maglr dashboard, open the Project settings of the project.
  2. Go to the Security tab and turn on Activate security.
  3. Turn on Automatically generate a login link.
  4. Click Save.
  5. From your application, send a POST request to /api/issue/{projectId}/hash, with the hours parameter set to how long the link should stay valid.
  6. Build the link from the returned code: https://<your project domain>/s/i/<code>, where <your project domain> is the domain the project is published on.
  7. Send the link to the user.


To stop a link from working before it expires, send a DELETE request to /api/issue/{projectId}/hash/{code}. A user who already opened the link can stay logged in to the project in that browser until the browser session ends.



The Maglr REST API has these requests for personal auto-login links. In each path, {projectId} is the ID of the project and {code} is the link code.


  • Create a link: POST /api/issue/{projectId}/hash?hours=24 creates a new link code. The link expires after the number of hours in hours, counted from the moment of the request. Without hours, the link expires after 24 hours.
  • List links: GET /api/issue/{projectId}/hash lists the project's personal links that haven't expired yet.
  • Get one link: GET /api/issue/{projectId}/hash/{code} returns one link code with its expiry time.
  • Extend a link: PUT /api/issue/{projectId}/hash/{code}?hours=N sets the link to expire N hours from the moment of the request.
  • Revoke a link: DELETE /api/issue/{projectId}/hash/{code} deletes the link, so it can no longer be used to log in.


Every request needs an OAuth access token for the Maglr API. The response contains the link code (hash) and its expiry time (date_expired), not a full URL. The link for the user is https://<your project domain>/s/i/<code>. To get API credentials and the API base URL, contact support.



A personal auto-login link expires after the number of hours your application sets when it requests the link (24 hours by default). The expiry has these effects:


  • Before the link expires, anyone who opens it is logged in to the project.
  • After the link expires, it no longer logs anyone in. The user needs a new link from your application.
  • A user who opened the link before it expired can stay logged in to the project in that browser until the browser session ends, for example when the browser is closed. This means access can continue after the link itself has expired.


To stop a personal auto-login link from working before it expires, revoke it with a DELETE request to /api/issue/{projectId}/hash/{code}. A user who already opened the link can stay logged in until their browser session ends.


Frequently asked questions



A personal auto-login link stays valid for the number of hours your application sets in the hours parameter when it requests the link. Without that parameter, the link expires after 24 hours. To extend a link, send a PUT request to /api/issue/{projectId}/hash/{code} with a new hours value; the new expiry is counted from the moment of that request.



Yes. Send a DELETE request to /api/issue/{projectId}/hash/{code} through the Maglr REST API. The link can no longer be used to log in after that. A user who already opened the link can stay logged in until their browser session ends.



No. An expired link can no longer be used to log in, but a user who already opened the link can stay logged in to the project in that browser until the browser session ends, for example when the browser is closed.



No. Personal auto-login links log in to one project that is secured in its own project settings, with Activate security turned on. A domain secured with an auto-login link uses its own fixed link and doesn't accept personal links.



Personal auto-login links are only available with a Maglr Enterprise license. Contact support for more information and for the API credentials you need to request the links.

Updated on: 23/10/2026