Testing magic-link login with a real email inbox
Use Agent Temp Mail to test passwordless login from email delivery through session creation, including link selection and single-use behavior.
On this page
Magic-link login puts the sign-in credential inside an email. A useful end-to-end test therefore needs to receive the message, choose the correct link, and prove that following it creates the expected session. Agent Temp Mail fits that workflow by giving automation a receiving inbox with structured message and link data.
Define what successful login means
Start with a test account and an inbox identity reserved for that scenario. Decide which account should be authenticated, which page should load after login, and what the application should do when the link has already been used. Write those expectations before automating the email step.
A redirect alone is a weak assertion. Check something that requires authentication, such as the account page showing the expected email address. This distinguishes a real session from a public landing page that happens to have a reassuring title.
Request and identify the right message
Record a timestamp before submitting the login form. Use the Agent Temp Mail address as the recipient, then wait for a newly received message from the application's expected sender. Keep the waiting period bounded so a delivery problem becomes a clear test failure.
Fetch the message and examine its link candidates. Choose the candidate with the expected origin and login path, rather than the first URL in the message. Email templates often contain several links, including help pages, logos, and preferences. A candidate is useful parsing output; your application-specific checks determine whether it is the login credential you need.
Use the right browser context
Some applications bind a magic-link request to the browser that initiated it. Others deliberately support opening the email on another device. Test the behavior your product promises. For a same-browser flow, open the link in the original context. For cross-device login, open it in a clean context and verify the resulting account.
After navigation, assert both the destination and authenticated identity. Where single-use behavior is part of the design, attempt a second visit in another clean context. An already authenticated session can otherwise hide whether a consumed link was accepted.
Cover resends deliberately
Test a resend as its own scenario. Request a second message and identify it using the new request time. Your application may invalidate the first link or allow both until expiry; assert the intended policy explicitly. Do not assume the newest-looking email is always the correct one when messages can arrive out of order.
Agent Temp Mail helps keep this test focused by handling inbox access and exposing the email's contents to your automation. With a dedicated identity, precise message selection, and a session assertion, passwordless login becomes a repeatable test instead of a manual release check.