# Passwordless Authentication

Account UI supports passwordless authentication via email OTP.

## Email OTP

When `VITE_ENABLE_EMAIL_OTP=true` (default: `false`):

- Users enter their email address
- A one-time password is sent via email
- User enters the OTP code to authenticate

The sign-in email contains the six-digit code only — no magic-link companion. Mail-client URL prefetching burns single-use links, so a code the user types is the reliable path.

## What about magic links?

Account UI does not offer a magic-link sign-in flow. The `magicLink` Better Auth plugin is still available at the API level (see [Auth Plugins](/platform/auth/plugins#magic-links)) for apps that build their own sign-in UI, but the bundled Account SPA is OTP-only by design.

## Related

- [Auth Plugins](/platform/auth/plugins) — Plugin configuration
- [Environment Variables](/ui/account/environment-variables)