Marked as helpful by the asker
Magic links assume one device, one browser. For shared machines use an OTP code instead: Supabase can send a 6-digit code (signInWithOtp with shouldCreateUser, then verifyOtp with type: 'email'). They type the code in the browser they're already in. Same security, no device hop.