There's a near-infinite amount of not-so-small gotchas when implementing magic links:
- If magic links are the only way to sign in, authentication success rate is now directly tied to your email deliverability rate.
- Single-use tokens (immediately expiring after clicking) can be followed by spam filters, and thus immediately become invalid for the actual user trying to sign in.
- MTAs using greylisting can cause unexpected delays in email delivery.
- If a session audit trail is implemented, malware scanners following links might cause sessions from unexpected locations showing up.
- If magic links are the only way to sign in, authentication success rate is now directly tied to your email deliverability rate.
- Single-use tokens (immediately expiring after clicking) can be followed by spam filters, and thus immediately become invalid for the actual user trying to sign in.
- MTAs using greylisting can cause unexpected delays in email delivery.
- If a session audit trail is implemented, malware scanners following links might cause sessions from unexpected locations showing up.
etc.