---
title: "Login with Code: Flexible Passcode-Based Authentication"
description: "With **Magic Login 2.4**, we introduced the `{{MAGIC_LOGIN_CODE}}` placeholder, allowing users to log in using a **passcode** instead of a login link. This feature improves the **login experience**, particularly for SMS-based authentication, where character limits and security concerns exist. **Unlike…"
url: "https://handyplugins.co/docs/magic-login-with-code/"
updated: "2025-03-05"
category: Magic Login Pro
---

# Login with Code: Flexible Passcode-Based Authentication

With **Magic Login 2.4**, we introduced the `{{MAGIC_LOGIN_CODE}}` placeholder, allowing users to log in using a **passcode** instead of a login link. This feature improves the **login experience**, particularly for SMS-based authentication, where character limits and security concerns exist.

**Unlike traditional OTPs**, Magic Login Codes offer flexibility by allowing **multiple uses** (configurable with token validity settings) and **customizable formats** via filters.

## **How Magic Login Code Works**

When `{{MAGIC_LOGIN_CODE}}` is detected in an **email or SMS message**, Magic Login:

1. **Generates a login code** dynamically based on the delivery method.
2. **Displays a code input form** instead of a login link on the login page.
3. **Validates the code** using:
   - **Token Validity Count** – Controls how many times a code can be used.
   - **TTL (Time-to-Live)** – Defines how long a code remains valid.

💡 **Token Validity and TTL are not new features**—they have always been part of Magic Login. The key enhancement in **2.4** is that the login method **automatically adapts** when `{{MAGIC_LOGIN_CODE}}` is used in templates.

## **Code Generation: Context-Aware Passcodes**

The **default format** of login codes depends on the delivery method:

| Context | Code Format | Example |
| --- | --- | --- |
| **SMS** | 6-digit PIN | `854321` |
| **Email** | 10-character alphanumeric (uppercase, no confusing characters) | `XK5T7P1M9Q` |

🔹 **For SMS** – A **6-digit PIN** is used for easy entry.
🔹 **For Email** – An **10-character alphanumeric code** improves security.

## H**ow to Use Magic Login Code in SMS & Email**

To enable **code-based login**, add `{{MAGIC_LOGIN_CODE}}` to your **SMS or email content**.

Example: SMS Content

```
Your login code: {{MAGIC_LOGIN_CODE}}. Enter it on the website to log in.
```

Example: Email Content

```
Use this passcode to log in: {{MAGIC_LOGIN_CODE}}. Or follow the link {MAGIC_LINK}}
```

If the template contains `{{MAGIC_LOGIN_CODE}}`, Magic Login **automatically switches** to code-based authentication, displaying a **code input form** instead of a login link. However, you can also use the link together too. It's not blocking the links.

## **Customizing Login Codes with Filters**

While Magic Login provides a **default** login code format, you can **fully customize** it using the `magic_login_create_user_token` filter.

### **Modify SMS Code Length**

If you want to **send a 10-character code** instead of a 6-digit PIN for SMS:

```
add_filter( 'magic_login_create_user_token', function( $new_token, $user_id, $context ) {
    if ( $context === 'sms_code' ) {
        return wp_rand( 1000000000, 9999999999 ); // 10-digit numeric code
    }
    return $new_token;
}, 10, 3 );
```

**Increase Email Code Complexity**

```
add_filter( 'magic_login_create_user_token', function( $new_token, $user_id, $context ) {
    if ( $context === 'email_code' ) {
        return strtoupper( substr( str_shuffle( 'ABCDEFGHJKLMNPQRSTUVWXYZ23456789!@#$%&*' ), 0, 12 ) );
    }
    return $new_token;
}, 10, 3 );
```

## Why Use Login Codes Instead of Links?

While **login links** are convenient, **Magic Login Codes** provide several benefits:

✅ **Shorter SMS Messages** – Login links can exceed **300-character SMS limits**, while a **6-digit code is compact**.
✅ **More Secure for SMS** – Links in SMS can be **phishing risks**, whereas a **PIN code minimizes this concern**.
✅ **Easier to Enter** – Users can **memorize** a short PIN and type it quickly.
✅ **Works with Email** – Users can receive either a **login link or passcode**, based on preferences.
✅ **Multi-use flexibility** – Unlike OTPs, Magic Login Codes **can allow multiple uses** if configured.

## Security Considerations & Best Practices

Since **SMS-based authentication** has security risks (e.g., **SIM swapping, interception**), we recommend:

🔒 **Short Token TTL (Time-to-Live)** – Reduce expiration time to **minimize attack windows**.
🔒 **Enable Rate-Limiting** – Prevent brute-force attempts by limiting login attempts per phone number.
🔒 **Use Multi-Factor Authentication (MFA)** – Add extra security for sensitive accounts.
🔒 **Use Token Validity Count** – Limit how many times a code can be used within a session.
🔒 **Customize Codes with Filters** – Adjust complexity and length as needed.

## **Final Thoughts**

Magic Login 2.4 introduces **Magic Login Codes**, giving users a **flexible, secure, and efficient** way to authenticate without relying on long login links. By leveraging **context-aware code generation, TTL, validity limits, and filters**, site owners can **fully customize the login experience** while keeping security in check. 🚀