From Dev.to
Magic Link Email Sessions: Audit Log Evidence for Edtech Revocation
Short answer: moving email login off a managed provider transfers responsibility for session revocation to your application, so make single-use email verification, refresh-token rotation, and a durabl...