Passwordless auth sounds like a simplification until you try to run it in a real Laravel product. The UI gets simpler. The security model does not. You remove the password field, but you still have to prove identity, prevent replay, handle hostile email infrastructure, preserve decent UX across devices, and give support a way to debug failures without turning into a manual override team.
That is why most magic-link examples are fine for prototypes and incomplete for production. They focus on generating a signed URL and calling Auth::login() when it is opened. That is the easy part. The hard part is everything around the click.
My recommendation is blunt: do not implement passwordless auth in Laravel as a “special login link” feature. Implement it as a short-lived authentication workflow with explicit state, single-use consumption, step-up hooks, and support visibility. If you skip those layers, you are not shipping passwordless auth. You are shipping a bearer token in an email and hoping the rest works out.
The first threat is often your user's email security stack
A lot of magic-link writeups quietly assume the first request to the link comes from the human who owns the inbox. In production, that assumption breaks fast.
