Instant, spam-proof passwordless magic link email delivery

import { SadaSend } from 'sadasend';

const sadasend = new SadaSend({ apiKey: process.env.SADASEND_API_KEY });

export async function sendMagicLink(recipientEmail: string, loginToken: string) {
  // Use intermediate landing confirmation to prevent corporate scanner token consumption
  const authUrl = `https://yourapp.com/auth/confirm?token=${loginToken}`;

  const { data, error } = await sadasend.emails.send({
    from: 'Auth <login@yourapp.com>',
    to: recipientEmail,
    subject: 'Sign in to your account',
    html: `
      <div style="font-family: sans-serif; max-width: 460px; margin: 0 auto;">
        <h2>Your Magic Sign-In Link</h2>
        <p>Click below to sign in instantly. No password required.</p>
        <p style="margin: 24px 0;">
          <a href="${authUrl}" style="background: #2563eb; color: #fff; padding: 12px 24px; text-decoration: none; border-radius: 6px; font-weight: 600;">Sign In Securely</a>
        </p>
        <p style="color: #64748b; font-size: 13px;">This link is single-use and expires in 10 minutes.</p>
      </div>
    `,
    headers: {
      'X-Auto-Response-Suppress': 'All', // Suppress Exchange/Outlook auto-responders
    },
    tags: ['auth', 'magic-link']
  });

  if (error) throw new Error(`Magic link failed: ${error.message}`);
  return data;
}