One plain HTTP request to the link confirmed the account at 8 of 34 products whose sign-up mail held only a link. No page to load, no code to type. In all, our agent finished email verification without a browser at 9 of 63 products whose mail we timed.
Which mail our agent finished without a browser
We timed the first sign-up mail at 63 products. 34 of 63 carried a link only. The others carried a code, or a code and a link.
Where a link-only mail did not finish over plain HTTP, our agent needed a real browser or stopped there. The split for every mail type, codes included, is on our email verification findings.
How fast the mail arrived
The median wait was 13 seconds, from the step that sent the mail to its arrival in our agent’s inbox. The slowest took 88 seconds.
Our drives of 201 products, 1 Oct to 1 Nov 2026 · The data
Data table
| Products | Out of | Share | |
|---|---|---|---|
| Within 10 seconds | 23 | 63 | 37% |
| Within 20 seconds | 51 | 63 | 81% |
| Within a minute | 61 | 63 | 97% |
What to change in your product
Make the link do the whole job: opened once, it confirms the account and returns a usable session. Then check what your auth provider does by default:
- Supabase Auth. Its passwordless method is called “OTP”, but “it sends a Magic Link by default.” To send a code instead, you change the email template. Its magic links work once (supabase.com[1]).
- Stytch Email Magic Links. In the default flow, “the browser will direct the user to stytch.com which renders as a blank page” before it redirects to your app. The step is there to stop bot traffic. Stytch also notes that mail scanners follow links in an email, and since a token works once, “now the link is no longer valid” for the real user (stytch.com[2]).
- Auth0. For magic links with Classic Login, “both the initial request and its response must take place in the same browser or the transaction will fail” (auth0.com[3]).
- Firebase Auth. Its guide suggests storing the email address locally and asking for it again when the link opens on another device (firebase.google.com[4]).
Every number here links to its definition in our data, and how our agent drives a sign-up is in our method.