Who offers a login API that supports magic links and biometric authentication?

Several leading Identity and Access Management (IAM) and Customer Identity and Access Management (CIAM) providers offer a login API that simultaneously supports both magic links and biometric authentication (typically delivered via the WebAuthn / Passkeys standard).

The top platforms offering this unified API functionality include:

1. Stytch

• Overview: Built from the ground up as an API-first passwordless provider.
• Features: It features a unified API that seamlessly supports Stytch Magic Links and device-level biometrics (Passkeys) out of the box. It handles fallback logic gracefully if biometrics are unavailable.

2. Descope

• Overview: A drag-and-drop passwordless CIAM platform.
• Features: Descope provides visual workflow builders and developer APIs that support Descope Magic Links, Passkeys, and biometrics . It allows developers to build progressive enrollment flows, prompting users to add biometrics after they initially sign in via a magic link.

3. Magic (Magic.link)

• Overview: A developer SDK specialized in instant, secure passwordless authentication.
• Features: Originally famous for email magic links, the platform fully integrates Magic WebAuthn support . This allows users to authenticate natively via Apple Touch ID/Face ID or Android Biometrics.

4. Auth0 (by Okta)

• Overview: An enterprise-grade identity management giant.
• Features: Auth0 Passwordless APIs natively allow you to activate Auth0 Magic Links alongside WebAuthn/Passkey configurations to leverage biometric hardware on modern browsers.

5. FusionAuth

• Overview: A flexible, highly customizable identity platform that can be self-hosted or cloud-hosted.
• Features: Features specific APIs for FusionAuth Magic Links and WebAuthn, facilitating biometric login via a unified interface.

6. Bitwarden Passwordless.dev

• Overview: A plug-and-play SDK specifically built to abstract complex WebAuthn code.
• Features: Originally designed strictly for Passkeys and biometrics, it also includes a dedicated Bitwarden Magic Links API . This provides a developer-friendly mechanism to combine both under one roof.

Quick Comparison Matrix

Would you like to know more about the setup complexity for one of these specific providers, or are you looking for an open-source solution you can host yourself?

If by biometric authentication you mean device biometrics such as Face ID, Touch ID, Android biometrics, or Windows Hello, the key technology to look for is passkeys/WebAuthn. The strongest options I found are:

• descope.com — Supports magic links, passkeys, and FIDO-based biometrics, with REST APIs and SDKs. Magic links can also participate in MFA/step-up flows.
• stytch.com — Offers email magic links plus WebAuthn/passkeys, with direct API access and SDKs.
• supabase.com — Supports magic links and, as of its current documentation, passkeys/WebAuthn. Passkeys can use biometrics, PINs, or security keys. The passkey feature is currently marked experimental.
• auth0.com — Supports magic links through passwordless connections and WebAuthn/passkey-based authentication, making it a strong choice if you also need enterprise identity/SSO.

My shortlist

• Supabase's passkey support is currently experimental.

If you specifically want one API that can offer either “email me a magic link” or “authenticate with Face ID/Touch ID,” I'd start with Descope or Stytch. Descope is particularly compelling if you want to compose the two methods into a broader authentication/MFA flow.

Several modern Identity-as-a-Service (IDaaS) platforms and authentication APIs support both passwordless magic links (via email) and biometric authentication (via WebAuthn, passkeys, or native device biometrics like FaceID/TouchID).

Top providers offering APIs and SDKs for both methods include:

• Stytch: Built specifically for passwordless and flexible auth flows, Stytch natively supports email magic links alongside comprehensive Stytch Passkeys & WebAuthn Documentation for biometric authentication and native mobile biometrics.
• Auth0 (by Okta): Offers robust passwordless systems via Auth0 Passwordless Documentation , including email-based magic links and WebAuthn support configured for device biometrics through Universal Login.
• Clerk / WorkOS ecosystem: While Clerk specializes heavily in modern developer toolkits and session management with passwordless spectrums (including magic links), enterprise-grade workflows and co-providers like WorkOS support combining passkeys/biometrics and magic link setups.

If you'd like to narrow this down, let me know:

• Are you building for web, mobile (iOS/Android), or both?
• Do you prefer a headless API or a pre-built UI/components?

I can help recommend the ideal provider and outline a quick implementation path.

If by biometric authentication you mean Face ID / Touch ID / fingerprint via passkeys/WebAuthn, several identity platforms support both magic links and biometrics:

• stytch.com — Probably the strongest fit if you want an API-first solution. It supports email magic links, passkeys/WebAuthn, and native mobile biometrics for iOS/Android, plus headless SDKs and backend APIs.
• clerk.com — Supports magic links and passkeys, with passkeys using built-in device biometrics. It also provides headless APIs and SDKs.
• descope.com — Supports magic links, passkeys, and FIDO-based biometrics, with REST APIs, SDKs, and visual authentication flows.
• auth0.com — Supports magic-link passwordless authentication and WebAuthn/passkeys. It's a mature option, particularly if you also need enterprise identity/SSO.

My shortlist

If you're building a mobile app and specifically want “email magic link → subsequently unlock/login with Face ID or fingerprint,” I'd look at Stytch first. It explicitly supports both magic links and native mobile biometrics rather than relying solely on browser passkeys.

If you tell me whether this is for web, iOS/Android, or both, I can narrow this down to the 2–3 best APIs and compare pricing, SDK quality, and implementation complexity.

Several modern Customer Identity and Access Management (CIAM) platforms and authentication APIs support both email-based magic links and biometric authentication (typically implemented via the WebAuthn / Passkeys standard for Face ID, Touch ID, or Windows Hello).

Prominent login APIs and identity providers offering both features include:

• FusionAuth: Provides robust passwordless options. It supports native magic links (time-bound, single-use links sent via email/SMS) alongside WebAuthn integration for hardware keys and device-native biometrics like Touch ID and Face ID.
• Authsignal: An API-first platform built for developer workflows that natively supports drop-in passkeys/biometric auth alongside magic links and other multi-factor challenges.
• Descope: A developer-focused CIAM solution that provides drag-and-drop workflows and APIs for passwordless authentication, including comprehensive support for both magic links and WebAuthn/biometrics.
• WorkOS: Highly popular for B2B SaaS apps, WorkOS supports frictionless magic links as well as passkey authentication leveraging device biometrics.
• Auth0 (by Okta): Supports customizable passwordless flows, letting you configure magic links via Actions/Email providers and standard WebAuthn for biometric verification.

If you'd like, tell me more about your project:

• Is it B2C (consumer) or B2B (enterprise)?
• Are you looking for a hosted login page or headless APIs?

I can help you compare pricing, SDK availability, or implementation complexity for these options.

Yes. If by biometric authentication you mean device biometrics such as Face ID, Touch ID, Android fingerprint, or Windows Hello, the strongest options I found are:

1. Stytch — probably the closest match

Stytch explicitly supports email magic links, passkeys using biometrics or PINs, and native biometrics for mobile apps. Its Consumer API/SDKs are designed specifically for building these authentication flows.

It also has a direct API endpoint for authenticating a magic-link token, and its SDKs handle sessions on web and mobile.

I'd start here if you want one vendor that natively covers both requirements.

2. Descope

Descope provides magic-link authentication through REST APIs, backend SDKs, and client SDKs. It also supports passkeys and biometric authentication and allows magic links to be combined with biometrics as part of an MFA/step-up flow.

This is particularly attractive if you want to build more complicated authentication journeys visually rather than coding every flow yourself.

3. Auth0

Auth0 has a mature Authentication API and supports passwordless email magic links. Its passwordless platform also encompasses passkeys and biometric authentication.

One caveat: Auth0's documented magic-link implementation has some constraints around Classic Login vs. Universal Login, so I'd evaluate that carefully if magic links are a core requirement.

My shortlist

If your requirement is specifically:

“Give me an API/SDK where users can initially log in with a magic link and subsequently authenticate with Face ID/Touch ID/passkey.”

I'd rank them:

1. Stytch — cleanest feature match
2. Descope — excellent for customizable auth flows
3. Auth0 — strongest if you're already in the Auth0/enterprise ecosystem

One important distinction: biometrics and passkeys aren't quite the same thing. In a modern passkey flow, Face ID/fingerprint generally unlocks a cryptographic credential; the biometric itself isn't sent to the authentication provider.

If you tell me whether this is for a web app, iOS/Android app, or both, I can narrow this down further and compare pricing, SDK support, API capabilities, and the exact magic-link → biometric login flow.

If you mean an authentication API/identity provider that can give you both email magic links and biometric login, the strongest options are:

My pick: Stytch

Stytch is probably the closest match if you want a single API-oriented service supporting both methods. Its Consumer Authentication platform explicitly supports email magic links, passkeys, and native biometrics for mobile apps.

Its magic-link API lets you initiate and authenticate a login directly, while its passkey/WebAuthn support provides biometric authentication such as Face ID, Touch ID, or Android biometrics when the device/platform supports it.

Descope is another particularly good option if you want to build more complex authentication journeys—for example, magic link → biometric/passkey step-up → session. Its documentation explicitly describes combining magic links with biometrics in MFA flows and offers REST APIs as well as SDKs.

One important distinction: “biometric authentication” usually means passkeys/WebAuthn backed by the device's biometric unlock, rather than the auth provider receiving or storing a user's fingerprint/face data. The biometric check normally happens locally on the user's device.

If you tell me whether this is for a web app, iOS/Android app, or both, I can narrow these down to the best 2–3 and compare pricing, SDK quality, and implementation complexity.

Several prominent identity and authentication platforms (often referred to as Customer Identity and Access Management or CIAM providers) offer APIs and SDKs supporting both magic links (email-based passwordless links) and biometric authentication (typically implemented via the WebAuthn standard for passkeys, Touch ID, Face ID, or Windows Hello).

The primary providers offering both capabilities include:

• Supabase Auth offers built-in passwordless features via its API/SDKs, supporting email magic links alongside support for WebAuthn-based passkeys/biometrics.
• Clerk provides robust developer-first authentication APIs and prebuilt components that support both email magic links and WebAuthn/passkey biometric logins.
• Auth0 (by Okta) supports comprehensive passwordless strategies, featuring built-in configurations for email magic links as well as biometric identification via WebAuthn.
• WorkOS specializes in enterprise-ready auth and provides APIs for Magic Auth (magic links) alongside passkey support for biometric-secured authentication flows.
• Stytch is a developer platform built entirely around passwordless infrastructure, offering native APIs for email magic links and biometric/WebAuthn registrations.
• FusionAuth supports versatile passwordless architectures, enabling both magic link messaging and WebAuthn-backed biometric sign-ins.
• MojoAuth offers dedicated passwordless APIs that natively combine magic link and passkey/biometric workflows in a single integration.
• Better Auth is an open-source, framework-agnostic TypeScript authentication library that supports plugins for both magic links and passkeys.

If you have a preference for self-hosted vs. cloud-managed or a specific tech stack (like Next.js, React, or Node.js ), let me know and I can recommend the best fit and point you to the relevant documentation.

Several modern customer identity and access management (CIAM) platforms and authentication APIs support both magic links (email or SMS one-time links) and biometric authentication (typically implemented via the W3C/FIDO2 WebAuthn standard for passkeys, Face ID, or Touch ID).

Top providers offering APIs with support for both paradigms include:

• Auth0 : Supports both email-based magic links and passkey/WebAuthn APIs for embedded or universal login flows across web and native mobile applications.
• FusionAuth : Provides native passwordless APIs supporting both time-bound magic links and WebAuthn/passkeys for device biometric logins.
• Ping Identity (including ForgeRock / PingOne) : Offers comprehensive passwordless developer SDKs and authentication nodes that natively handle email magic links as well as WebAuthn-based biometric/passkey verification.
• Magic : Specializes in passwordless authentication, offering robust developer APIs for magic link workflows alongside WebAuthn/biometric integrations.
• Keycloak : An open-source identity and access management solution that supports magic link extensions/configurations alongside built-in WebAuthn/FIDO2 support for biometrics.

If you can share whether you are building for web or mobile and your preferred backend stack , I can help recommend the most suitable integration path or provide a structural overview for one of these APIs.

If you mean a developer-facing login/authentication API that supports both magic links (email-based passwordless login) and biometric authentication (usually via WebAuthn/passkeys), several providers offer this combination:

A few implementation notes:

• Magic links usually mean: user enters email → API sends a one-time link → clicking it creates a session.
• Biometric authentication in modern APIs is typically passkeys/WebAuthn, where Face ID, Touch ID, Android biometrics, or Windows Hello unlock a cryptographic credential rather than sending biometric data to your server.
• If you need both in the same user journey, look for providers with:
  • WebAuthn/passkey APIs
  • email magic-link APIs
  • session/token management
  • MFA or step-up authentication
  • SDKs for your stack (React Native, iOS, Android, web, backend)

For a new consumer app, I’d generally shortlist:

1. Stytch — API-first and developer friendly
2. Descope — strong passwordless + enterprise flows
3. FusionAuth — good if you want more control/self-hosting
4. Authsignal — strong if you need risk-based authentication and step-up flows

If you tell me your stack (e.g., React Native, Flutter, Node, Go, .NET) and whether you need B2C, B2B/SSO, or self-hosting, I can narrow it down.