Email Magic Link for Laravel is a passwordless authentication package that lets users sign in via an emailed link or one-time code. It solves the common problem of email scanners burning single-use tokens by splitting the flow: a GET request renders a confirmation page while a POST actually consumes the token. The package integrates with Laravel Fortify, routing TOTP-enabled users to the two-factor challenge before authentication rather than bypassing it. Tokens are stored as keyed HMAC-SHA256 hashes, each with its own brute-force lockout. A mint API lets developers issue links and codes for delivery over SMS or custom channels. Resend limiting uses escalating cooldowns (30s, 60s, 120s) plus a rolling hourly cap. Requires PHP 8.4 and Laravel 13; Fortify is optional.
