Check if possible: Auto-Send OTP via Email Upon Redirect

Help
,
1

Dear Auth0 Team,

I am exploring the feasibility of implementing the following passwordless login experience and would like your guidance on whether this is possible with Auth0:

  1. An after-care provider (whose email is already registered in my marketplace, but not might have an account yet in Auth0) receives a custom link (URL?email=after@careprovider.com) to access a hospital’s patient file on our platform, secured by an Auth0 login.

  2. Upon clicking the “View File” link in the email:

  • Scenario 1: If the provider is already logged in, they are immediately shown the patient file.
  • Scenario 2: If the provider is not logged in, they are presented with a panel (= step 2 in the universal login - passwordless) to enter a one-time code, which was automatically sent to their known email address upon redirect when scenario 2 was detected.
  1. Upon successful validation of the code, the patient file is displayed.

Could you please confirm if this flow can be implemented using Auth0? If so, I would appreciate any relevant documentation or guidance to help me get started.

Thank you for your assistance!

PS: I’m dealing with sensitive data - if this seems not a secure way to send data (instead of using email attachments) please raise your concerns. In that case I will find another solution.

2

This approach is actually more secure than email attachments because:

  • Authentication is required before accessing data
  • Data never leaves your secure environment
  • Access can be revoked at any time
  • You maintain an audit trail of access

If I understand correctly, this is what you want to achieve. I have added both scenario in the high level diagram.

image
image819×982 28.2 KB

You can find Passwordless Authentication with Email here:

Hope this helps!

3

Thank you for visualizing the flow—it’s spot on!

After reviewing the documentation further, it seems we need to take the custom route for this:

Auth0: Relevant API Endpoints for Embedded Login

By going this route, we can develop a custom frontend page that addresses both Scenario 1 and Scenario 2, potentially incorporating a tailored UI on our platform to handle unlocking the patient file seamlessly.

From what I understand, this functionality isn’t available out of the box—would you agree?