Live

Sign in with magic links and passkeys

ArtDrop has no passwords. Sign in with a one-time email link that lasts 15 minutes, then add an optional passkey (Touch ID or Face ID) for a one-tap return.

Availability
Live
Last verified

What this does

ArtDrop has no passwords. Sign in with a one-time email link that lasts 15 minutes, then add an optional passkey (Touch ID or Face ID) for a one-tap return.

Before you begin

  • Have the email address on your ArtDrop account, and open your inbox on a device you trust.
  • Passkeys are optional. The email link works on its own, so you never have to set one up.

What changes outside ArtDrop

Requesting a magic link can send a sign-in email. A valid token row not yet marked used can create a session, but concurrent claims are not atomically serialized. Passkey enrollment stores a credential ID, public key, and sign counter. The backend does not receive biometric data.

Sign in. Sign in with a magic link, no password, then add a passkey for one-tap returns.
ArtDrop sign-in screen with Email me a magic link and an I have a passkey button, signed out.
Set up a passkey. Add a passkey so future sign-ins are one tap, no email round trip, no password.
ArtDrop Set up a passkey screen offering a platform authenticator, with Create passkey and Skip for now.

Steps

  1. Request the link

    Open /login, type the email on your account, and choose Email me a magic link. The confirmation screen notes that the link expires in 15 minutes.

  2. Open the newest link

    Open the newest email link. A link is rejected after its token row is marked used or expired, but the backend does not atomically guarantee only one concurrent success.

  3. Add a passkey (optional)

    Choose Create passkey and follow the platform authenticator prompt, such as Touch ID, Face ID, Windows Hello, or a device PIN. Enrollment requires a discoverable platform credential with user verification; the backend does not offer roaming security-key enrollment. Skip for now keeps email available.

  4. Return with a tap

    On later visits, choose I have a passkey (Touch ID) and confirm with your fingerprint or face. No email needed. If you never enrolled a passkey, request another magic link instead.

  5. Sign out

    Sign out clears this browser session and deletes its cookie. Server-side revocation is best-effort, so do not assume a copied cookie is always invalidated immediately.

Expected result

A valid fresh email link or a successfully verified enrolled passkey can create a signed-in session. Email delivery, authenticator availability, database access, and license attachment remain separate dependencies.

Good to know

  • Magic-link tokens expire 15 minutes after request and are rejected after their row is marked used. The separate read and update do not atomically guarantee only one concurrent success.
  • Enrollment requires the device's platform authenticator and user verification. Depending on the platform, that can be Touch ID, Face ID, Windows Hello, or a device PIN. Roaming security-key enrollment is not offered by this backend.
  • Hosted inactivity timeout defaults to 30 minutes but is environment-configurable. Missing database access and transient validation errors fail open, so the timeout is not an absolute guarantee.
  • Concurrent hosted sessions default to three. The value is environment-configurable, enforcement is best-effort, and Shopify review sessions are exempt.

Troubleshooting

  • No email? Check spam, give it a minute, and request just one fresh link rather than opening several old ones.
  • If a passkey prompt fails or the device has no enrolled credential, cancel it and request a magic link. Access still depends on successful email delivery and the account's current authentication and license state.
  • If a link is incomplete, open the full newest link from the email or request one new link.
  • A passkey error before the browser confirms credential discovery does not prove no passkey exists. Check the connection or sign in with email.
  • If a session expires, sign in with email or an enrolled passkey. License attachment is a separate signed-in step.

How to undo or clean up

Sign out clears this browser session and cookie; server-side revocation is best-effort. ArtDrop exposes no self-service passkey deletion route. Removing a credential in the device manager stops that local credential, but the server public-key record remains until account erasure or backend support removes it.