From 55b67da016242ef0ef3b1bfb37fdbb0ec9679dd1 Mon Sep 17 00:00:00 2001
From: Md Sufiyan <kanekigaming786@gmail.com>
Date: Thu, 1 Oct 2026 12:23:51 +0530
Subject: [PATCH] docs(magic-link): correct APIMethod contract and document
 rateLimit (#11497)

Co-authored-by: Taesu <bytaesu@gmail.com>
---
 docs/content/docs/plugins/magic-link.mdx | 20 ++++++++++++++++----
 1 file changed, 16 insertions(+), 4 deletions(-)

diff --git a/docs/content/docs/plugins/magic-link.mdx b/docs/content/docs/plugins/magic-link.mdx
index e0800be297..e653361a23 100644
--- a/docs/content/docs/plugins/magic-link.mdx
+++ b/docs/content/docs/plugins/magic-link.mdx
@@ -55,7 +55,7 @@ Magic link or email link is a way to authenticate users without a password. When
 
 To sign in with a magic link, you need to call `signIn.magicLink` with the user's email address. The `sendMagicLink` function is called to send the magic link to the user's email.
 
-<APIMethod path="/sign-in/magic-link" method="POST" requireSession>
+<APIMethod path="/sign-in/magic-link" method="POST" requireHeaders>
   ```ts
   type signInMagicLink = {
       /**
@@ -71,11 +71,11 @@ To sign in with a magic link, you need to call `signIn.magicLink` with the user'
        */
       callbackURL?: string = "/dashboard"
       /**
-       * URL to redirect after new user signup
+       * URL to redirect after new user signup.
        */
       newUserCallbackURL?: string = "/welcome"
       /**
-       * URL to redirect if an error happen on verification
+       * URL to redirect if an error happens on verification
        * If only callbackURL is provided but without an `errorCallbackURL` then they will be 
        * redirected to the callbackURL with an `error` query parameter.
        */
@@ -106,7 +106,7 @@ When you send the URL generated by the `sendMagicLink` function to a user, click
 
 If you want to handle the verification manually, (e.g, if you send the user a different URL), you can use the `verify` function.
 
-<APIMethod path="/magic-link/verify" method="GET" requireSession>
+<APIMethod path="/magic-link/verify" method="GET" requireHeaders>
   ```ts
   type magicLinkVerify = {
       /**
@@ -117,6 +117,16 @@ If you want to handle the verification manually, (e.g, if you send the user a di
        * URL to redirect after magic link verification, if not provided will return the session. 
        */
       callbackURL?: string = "/dashboard"
+      /**
+       * URL to redirect after new user signup.
+       */
+      newUserCallbackURL?: string = "/welcome"
+      /**
+       * URL to redirect if an error happens on verification.
+       * If only callbackURL is provided but without an `errorCallbackURL` then they will be
+       * redirected to the callbackURL with an `error` query parameter.
+       */
+      errorCallbackURL?: string = "/error"
   }
   ```
 </APIMethod>
@@ -138,6 +148,8 @@ and a `ctx` context object as the second parameter.
 
 **disableSignUp**: If set to `true`, the user will not be able to sign up using the magic link. The default value is `false`.
 
+**rateLimit**: Rate limit for the `/sign-in/magic-link` and `/magic-link/verify` endpoints. The default value is `{ window: 60, max: 5 }`. See [Rate Limit](/docs/concepts/rate-limit) for details.
+
 **generateToken**: The `generateToken` function is called to generate a token which is used to uniquely identify the user. The default value is a random string. There is one parameter:
 
 * `email`: The email address of the user.