# The Magic Link API is deprecated

WorkOS API deprecated POST /passwordless/sessions* without giving a shutdown date yet.

WorkOS deprecated the Magic Link API without a shutdown date. The deprecation affects requests made to POST /passwordless/sessions*. When removed, calls to these endpoints will fail, as Magic Link has been replaced by the AuthKit Magic Auth API.

## What to use instead

Send a one-time code using POST /user_management/magic_auth and authenticate the user via POST /user_management/authenticate with the urn:workos:oauth:grant-type:magic-auth:code grant type. Adopting Magic Auth requires more than changing an identifier, as it belongs to AuthKit User Management and changes how the application manages users by storing them in WorkOS.

Magic Auth belongs to AuthKit User Management, which keeps the users in WorkOS: adopting it changes how the app manages users.

- API: WorkOS API (api.workos.com)
- Kind: Endpoint removal
- Takes effect: no date given yet
- Calls after that day: fail
- Calls it hits: `POST /passwordless/sessions*`
- Source: [Announcement](https://workos.com/docs/reference/magic-link)
- Verified: October 26, 2026, against WorkOS API's own pages
- Page: https://www.okapi.bot/providers/workos-api/breaking-changes/the-magic-link-api-is-deprecated/

## WorkOS API's words

> Magic Link has been replaced by the AuthKit Magic Auth API

Okapi finds the calls this change hits in your repo and opens the pull request with the fix: https://github.com/apps/okapi-agent