How do magic links work, and what is their main weakness?

Question

Accepted Answer

The service e-mails (or texts) a unique, single-use, short-lived link; clicking it proves control of the mailbox and logs the user in. The main weakness is that the e-mail account becomes the single key to the service.
The flow: the user enters an e-mail address, the server generates a long random token, stores it with an expiry time, and sends a link containing it. When the link is opened, the server checks the token, invalidates it and opens a session. The user never chooses or remembers a password.
Why it is attractive: no password to reuse, forget or leak from a database, and no password-reset flow, since every login already works like one.
Why it is limited:

It is single-factor (possession of the mailbox), so its strength equals the strength of the mail account's own login.
The link travels through e-mail or SMS, channels that can be intercepted, forwarded or read on a shared device.
Link-scanning security filters may "click" the link before the user does, and users can be phished with fake login links.

Magic links are therefore convenient for low-risk services, but they do not replace MFA for sensitive accounts.
Go deeper:

OWASP Forgot Password Cheat Sheet — the same single-use URL token pattern, with its requirements for randomness, expiry and single use.