Two weeks ago I built a side project over a weekend. Saturday morning, I needed auth. I allocated 30 minutes. Twenty minutes later, auth was done. I spent the rest of the weekend building actual features. This is exactly how I did it using Turalogin, a hosted passwordless authentication service. ## What We're Building By the end of this tutorial, you'll have: - ✅ Login form that accepts email - ✅ Passwordless magic link sent to user's email - ✅ Token verification server-side - ✅ Session creation with httpOnly cookies - ✅ Protected routes - ✅ Logout functionality All in 20 minutes. No password hashing. No email infrastructure to set up. No token management. ## Prerequisites - A Next.js/Express/Django/Rails app (any backend) - 20 minutes - That's it ## Step 1: Get Your API Key (2 minutes) 1. Go to [turalogin.com/login](https://turalogin.com/login) 2. Enter your email 3. Click the login link from your email 4. Create an app in the dashboard 5. Copy your API key Done. Two minutes. ## Step 2: Environment Variables (1 minute) Add to your `.env.local` (or `.env`): ```bash TURALOGIN_API_KEY=your_api_key_here BASE_URL=http://localhost:3000 # Your app's URL ``` One minute. ## Step 3: Create the Login Page (3 minutes) ```tsx // app/login/page.tsx (or wherever your login page is) "use client"; import { useState } from "react"; export default function LoginPage() { const [email, setEmail] = useState(""); const [sent, setSent] = useState(false); const [loading, setLoading] = useState(false); async function handleSubmit(e: React.FormEvent) { e.preventDefault(); setLoading(true); await fetch("/api/auth/login", { method: "POST", headers: { "Content-Type": "application/json" }, body: JSON.stringify({ email }), }); setSent(true); setLoading(false); } if (sent) { return (

Check your email

We sent a login link to {email}

); } return (

Login

); } ``` Three minutes. Standard form. Nothing fancy. ## Step 4: Create the Login API Route (5 minutes) ```typescript // app/api/auth/login/route.ts (Next.js App Router) // Or your equivalent API route import { NextRequest, NextResponse } from "next/server"; export async function POST(request: NextRequest) { const { email } = await request.json(); // Validate email if (!email || !email.includes("@")) { return NextResponse.json( { error: "Invalid email" }, { status: 400 } ); } // Request magic link from Turalogin const response = await fetch( "https://api.turalogin.com/v1/auth/start", { method: "POST", headers: { "Content-Type": "application/json", "X-API-Key": process.env.TURALOGIN_API_KEY!, }, body: JSON.stringify({ email, method: "magic_link", validationUrl: `${process.env.BASE_URL}/auth/verify`, }), } ); if (!response.ok) { return NextResponse.json( { error: "Failed to send login link" }, { status: 500 } ); } return NextResponse.json({ success: true }); } ``` Five minutes. One API call to Turalogin. That's it. ## Step 5: Create the Verification Route (6 minutes) ```typescript // app/auth/verify/route.ts import { NextRequest, NextResponse } from "next/server"; import { cookies } from "next/headers"; export async function GET(request: NextRequest) { // Get token from URL const token = request.nextUrl.searchParams.get("token"); if (!token) { return NextResponse.redirect(new URL("/login?error=no_token", request.url)); } // Verify token with Turalogin const response = await fetch( "https://api.turalogin.com/v1/auth/verify", { method: "POST", headers: { "Content-Type": "application/json", "X-API-Key": process.env.TURALOGIN_API_KEY!, }, body: JSON.stringify({ sessionId: token }), } ); if (!response.ok) { return NextResponse.redirect( new URL("/login?error=invalid_token", request.url) ); } const data = await response.json(); const { user } = data; // Create session (using httpOnly cookie) const sessionToken = generateSessionToken(); // Your session token generator await saveSession(sessionToken, user.id, user.email); // Your session storage // Set cookie const cookieStore = await cookies(); cookieStore.set("session", sessionToken, { httpOnly: true, secure: process.env.NODE_ENV === "production", sameSite: "lax", maxAge: 60 * 60 * 24 * 30, // 30 days path: "/", }); // Redirect to dashboard return NextResponse.redirect(new URL("/dashboard", request.url)); } // Simple session helpers (implement with your database) function generateSessionToken() { return Math.random().toString(36).substring(2) + Date.now().toString(36); } async function saveSession(token: string, userId: string, email: string) { // Save to your database // Example: await db.insert(sessions).values({ token, userId, email, expiresAt: . }); } ``` Six minutes. This includes session creation. Note: The session helpers are simplified. Use your actual database/session store. ## Step 6: Session Middleware (2 minutes) ```typescript // middleware.ts (Next.js) or equivalent import { NextResponse } from "next/server"; import type { NextRequest } from "next/server"; export async function middleware(request: NextRequest) { // Get session cookie const session = request.cookies.get("session")?.value; // Check if route needs auth if (request.nextUrl.pathname.startsWith("/dashboard")) { if (!session) { return NextResponse.redirect(new URL("/login", request.url)); } // Verify session exists in database const isValid = await verifySession(session); if (!isValid) { return NextResponse.redirect(new URL("/login", request.url)); } } return NextResponse.next(); } async function verifySession(token: string): Promise { // Check database for valid session // Example: const session = await db.select().from(sessions).where(eq(sessions.token, token)); // return !!session; return true; // Placeholder } export const config = { matcher: ["/dashboard/:path*"], }; ``` Two minutes. Protected routes are done. ## Step 7: Logout (1 minute) ```typescript // app/api/auth/logout/route.ts import { NextRequest, NextResponse } from "next/server"; import { cookies } from "next/headers"; export async function POST(request: NextRequest) { const session = request.cookies.get("session")?.value; if (session) { // Delete session from database await deleteSession(session); } // Clear cookie const cookieStore = await cookies(); cookieStore.delete("session"); return NextResponse.json({ success: true }); } async function deleteSession(token: string) { // Delete from database // Example: await db.delete(sessions).where(eq(sessions.token, token)); } ``` One minute. ## Total Time: 20 Minutes Let's add it up: 1. Get API key: 2 minutes 2. Environment variables: 1 minute 3. Login page: 3 minutes 4. Login API route: 5 minutes 5. Verification route: 6 minutes 6. Middleware: 2 minutes 7. Logout: 1 minute **Total: 20 minutes** ## What You Just Built You now have: ✅ **Passwordless authentication** - No passwords to hash or store ✅ **Email-based login** - Users click a link to authenticate ✅ **Backend verification** - Tokens never touch the browser ✅ **Secure sessions** - httpOnly cookies with proper security settings ✅ **Protected routes** - Middleware guards your dashboard ✅ **Logout** - Clean session termination ## What You Didn't Build You avoided: ❌ Password hashing logic ❌ Email infrastructure (SMTP, deliverability, SPF/DKIM) ❌ Token generation and storage ❌ Password reset flow ❌ Email verification flow ❌ Rate limiting for auth endpoints (Turalogin handles it) ❌ OAuth provider configuration All that complexity is handled by Turalogin. ## Customization Points The implementation above is minimal. You can customize: ### Email Template Turalogin sends branded emails with your app name. The emails are professional and mobile-friendly by default. ### Session Duration ```typescript maxAge: 60 * 60 * 24 * 30, // 30 days // Or make it shorter: maxAge: 60 * 60 * 24 * 7, // 7 days // Or longer: maxAge: 60 * 60 * 24 * 90, // 90 days ``` ### Redirect After Login ```typescript // Instead of /dashboard, redirect wherever you want return NextResponse.redirect(new URL("/custom-page", request.url)); ``` ### Session Storage Use whatever you prefer: - PostgreSQL/MySQL table - Redis - In-memory (for development) - Session library like `express-session` ## Common Questions ### "Does this work with [framework]?" Yes. Turalogin is two HTTP endpoints. Any backend that can make HTTP requests works: - Next.js (shown above) - Express: Same logic, different syntax - Django: Same logic, different syntax - Rails: Same logic, different syntax - Go/Rust/PHP/Java: Same logic, different syntax The pattern is identical across all frameworks. ### "What about mobile apps?" Mobile apps can use the same flow: 1. App sends email to your backend 2. Backend requests magic link 3. User clicks link on mobile 4. Deep link opens your app 5. App extracts token, sends to backend 6. Backend verifies and returns session Same verification logic. Different UX for link handling. ### "Can I customize the email?" Turalogin emails include your app name. For fully custom emails, you can: 1. Use Turalogin for the verification logic 2. Send your own emails with the token 3. Handle token validation through Turalogin's API Contact support for custom email templates. ### "What if I need more than just email?" You can add: - **OAuth for integrations** - Use OAuth for GitHub/Google API access, Turalogin for authentication - **Role-based access** - Store roles in your database, check them in middleware - **Team management** - Build on top of the basic auth - **Multi-tenant** - Add tenant IDs to your session data Turalogin handles identity verification. You build everything else. ## Next Steps Now that auth is done in 20 minutes, spend the rest of your time building actual features: 1. **User onboarding** - What happens after first login? 2. **Core features** - The reason your app exists 3. **Dashboard** - User-specific data and actions 4. **Settings** - Profile, preferences, etc. Auth is infrastructure. Get it working quickly so you can focus on what makes your app unique. ## The Complete Code For the complete, working example with all the pieces: ```bash # Clone the example repo git clone https://github.com/turalogin/examples cd examples/nextjs-quickstart # Install dependencies npm install # Add your API key to .env.local echo "TURALOGIN_API_KEY=your_key_here" > .env.local echo "BASE_URL=http://localhost:3000" >> .env.local # Run it npm run dev ``` Visit `localhost:3000`, enter your email, and see it work. ## Why This Works Most auth implementations take days because they include: - Password hashing and validation - Email sending infrastructure - Token generation and management - Password reset flows - Email verification - Rate limiting - Security best practices Turalogin handles all of that. You make two API calls and create your session. That's why it takes 20 minutes instead of 3 days. ## The Time Trade-Off **Traditional auth implementation:** - Day 1: Password hashing, validation, storage - Day 2: Email infrastructure, templates, deliverability - Day 3: Password reset, email verification - Day 4+: Security hardening, edge cases, testing **With Turalogin:** - 20 minutes: Working authentication - Rest of the week: Build your product The choice is obvious. --- *Ready to implement auth in 20 minutes? [Get your API key](/login) and start building.*