Magic Link REST API: Create and Revoke Login Links

Q: What does deleting a link through the API actually do?

DELETE /kc-ml/v1/links/{id} revokes every active magic link belonging to the user that id points to, not only the single link. It is designed to cut off a person's access completely in one call, which is what you usually want when offboarding someone or responding to a suspected leak.

Q: Can I change which capability each endpoint requires?

Yes. By default writing (create and revoke) needs editusers and reading (list and look-up) needs listusers. Developers can override these with the kcmlrestwritecapability and kcmlrestreadcapability filters, for example to grant a custom role access without giving it full user-editing rights.

Need to create passwordless login links from a system that is not WordPress — a mobile app, a CRM, or an automation platform? Magic Link PRO ships a REST API under the kc-ml/v1 namespace that lets any authorized system generate, list, look up, and revoke magic links. It is secured with standard WordPress application passwords and capability checks, so you never share a real account password and can withdraw access at any time.

For the full interactive endpoint reference — every path, parameter, and request/response schema you can try in the browser — see the API Reference. This page is the narrative walkthrough that explains how to authenticate and use it.

PRO feature

The REST API is available in Magic Link PRO. If you only need links inside WordPress, the admin Create Magic Link form and the integrations cover that without any code.

What is the Magic Link REST API?

The Magic Link REST API is a set of endpoints registered under the WordPress REST namespace kc-ml/v1. It exists for the case where the thing that decides someone should be logged in lives outside WordPress:

A mobile app. Your app authenticates its own users. When one opens your website, the app requests a magic link and sends them there already signed in, instead of a second login.
A tool outside WordPress. A CRM, a booking system, or an internal dashboard can hand someone a working link into your site at exactly the right moment.
Automation platforms. Zapier, Make, and n8n can call the API as an action, so "new row in a spreadsheet" or "deal marked won" produces a login link with no code.
Offboarding. Revoke a user's links programmatically when someone cancels or leaves, instead of relying on someone remembering.

Pair it with webhooks and the loop closes: your system creates links, and your site reports back what happened to them.

Endpoints

All endpoints live under the kc-ml/v1 namespace.

Method	Endpoint	Purpose	Required capability
`POST`	`/kc-ml/v1/links`	Generate a link for a `user_id` or `email`	`edit_users`
`GET`	`/kc-ml/v1/links`	List link events (paginated)	`list_users`
`GET`	`/kc-ml/v1/links/{id}`	Look up one link event by id	`list_users`
`DELETE`	`/kc-ml/v1/links/{id}`	Revoke every active link for that user	`edit_users`

Generate a link

Send a POST to /kc-ml/v1/links identifying the person by either user_id or email. The response returns the resolved user, the ready-to-use link, and how long it stays valid:

{
  "user_id": 42,
  "url": "https://example.com/?magic-link=…",
  "expires_in": 300
}

List and look up links

GET /kc-ml/v1/links returns link events from the audit log. It is paginated with page and per_page, and per_page is capped at 100 per request, so work through long histories a page at a time. GET /kc-ml/v1/links/{id} returns a single event by its id.

Revoke links

DELETE /kc-ml/v1/links/{id} revokes all active links for the user that the id belongs to, not just the one link. Use it to cut off access for a person in a single call.

Authentication and capabilities

The API uses application passwords, a built-in WordPress feature, plus a capability check on every request. This means you never put a real account password into another system, and revoking an application password takes effect immediately.

In WordPress, go to Users and edit the account the integration should act as.
Scroll to Application Passwords.
Enter a name that identifies the system — "Mobile app", "Zapier" — so you know what to revoke later.
Click Add New Application Password.
Copy the generated password immediately. It is shown only once.
Give that value, and the username, to the system that will call the API.

The account must hold the capability the endpoint requires: edit_users for creating and revoking, list_users for reading. These are the defaults; developers can change them with the kc_ml_rest_write_capability (create/revoke) and kc_ml_rest_read_capability (list/look-up) filters.

Good practice

One application password per system, so cutting one off does not disturb the others.
Use a dedicated account with only the capability it needs, not your own administrator login.
HTTPS only. Never send API credentials over plain http.
Revoke unused credentials. Deleting an application password takes effect immediately.

Keep the credentials safe

A magic link is a working key to an account, and anything that can call this API can create keys. Treat the credentials with the same care as an administrator password:

Store them in your automation tool's secret storage, not a spreadsheet or shared document.
Do not paste them into support tickets, chat, or screenshots.
If a credential may have leaked, revoke it under Users → Profile → Application Passwords straight away, then revoke any suspicious links, since existing links stay valid until they expire.

Conclusion

The Magic Link PRO REST API lets an outside system create, list, and revoke passwordless login links over kc-ml/v1, authenticated with WordPress application passwords and capability checks. Set up a dedicated account, generate an application password, and you can drive magic links from a mobile app or automation. Next, add webhooks so your site reports back what happens to those links.

FAQs

Is the Magic Link REST API free?

No. The REST API is part of Magic Link PRO. The free plugin lets you create links inside WordPress with the admin Create Magic Link form, the Users list button, and WP-CLI, but the kc-ml/v1 REST endpoints for external systems are a PRO feature.

How do I authenticate requests to the API?

Use WordPress application passwords. Edit the WordPress user the integration should act as, create an application password under their profile, and send it with the username using HTTP Basic authentication over HTTPS. The account must also hold the required capability — edit_users to create or revoke links, list_users to read them.

What does deleting a link through the API actually do?

DELETE /kc-ml/v1/links/{id} revokes every active magic link belonging to the user that id points to, not only the single link. It is designed to cut off a person's access completely in one call, which is what you usually want when offboarding someone or responding to a suspected leak.

Can I change which capability each endpoint requires?

Yes. By default writing (create and revoke) needs edit_users and reading (list and look-up) needs list_users. Developers can override these with the kc_ml_rest_write_capability and kc_ml_rest_read_capability filters, for example to grant a custom role access without giving it full user-editing rights.

Can I use the API with Zapier, Make, or n8n?

Yes. Because the endpoints are standard authenticated WordPress REST calls, any platform that can make an HTTP request with Basic authentication can call them. Store the application password in the platform's secret storage and trigger POST /kc-ml/v1/links from an automation to hand someone a login link at the right moment.