Developers
How Can I Create Magic Links From My Own App Or Automation?
Quick Answer
This is a Pro feature. Magic Link provides a REST API at kc-ml/v1 that lets another system create, look up, and revoke magic links. It is secured with WordPress application passwords.
This page involves a developer or an automation tool. If you only need links inside WordPress, the admin screen and the integrations cover that without any of this.
Why This Helps
The API is for when the thing that decides someone should be logged in is not WordPress.
- A mobile app. Your app authenticates its own users. When one taps something that opens your website, the app can request a magic link and send them there already signed in, rather than presenting a second login.
- A tool outside WordPress. A CRM, a booking system, or an internal dashboard can hand someone a working link into your site at exactly the right moment.
- Automation platforms. Zapier, Make, and n8n can call the API as an action, so "new row in a spreadsheet" or "deal marked won" can produce a login link with no code.
- Cleaning up. Revoke links programmatically when someone cancels, leaves, or is offboarded, instead of relying on someone remembering.
Pair it with webhooks and the loop closes: your system creates links, and your site reports back what happened to them.
What You Can Do
All endpoints live under kc-ml/v1:
| Action | Endpoint |
|---|---|
| Create a magic link | POST /kc-ml/v1/links |
| List magic links | GET /kc-ml/v1/links |
| Look up one magic link | GET /kc-ml/v1/links/{id} |
| Revoke a magic link | DELETE /kc-ml/v1/links/{id} |
When creating a link you identify the person either by user_id or by email. Listing supports page and per_page so you can work through a long list.
Setting Up Access
The API uses application passwords, a standard WordPress feature. This means you never put a real account password into another system, and you can withdraw access at any time without changing anyone's login.
- In WordPress, go to Users and edit the account the integration should act as.
- Scroll to Application Passwords.
- Enter a name that identifies the system — "Mobile app", "Zapier" — so you know what to revoke later.
- Click Add New Application Password.
- Copy the generated password immediately. It is shown once.
- Give that value, and the username, to the system that will call the API.
Good practice
- One application password per system. If you ever need to cut one off, you do not disturb the others.
- Use a dedicated account with only the permissions it needs, rather than your own administrator login.
- Revoke unused ones. Deleting an application password takes effect immediately.
- HTTPS only. Never send API credentials over plain
http.
Security Worth Understanding
A magic link is a working key to an account. Anything that can call this API can create keys.
Treat the credentials with the same care as an administrator password:
- Store them in your automation tool's secret storage, not in a spreadsheet or a shared document.
- Do not paste them into support tickets, chat, or screenshots.
- If a credential may have leaked, revoke it in Users -> Application Passwords straight away. Existing links stay valid until they expire, so revoke any suspicious links too.
Getting Help
The exact request format, parameters, and responses are developer detail beyond this guide. If you are wiring up an integration and need specifics, contact support — include what you are building and which endpoint you are using.