According to statistics, 30% of users abandon an app when they encounter login issues. Email verification is one of the critical bottlenecks. On a project with 100k DAU, every third user could not log in due to verification errors. After migrating to Magic Link with OTP fallback, conversion increased by 25%. We often encounter situations where the confirmation email is not delivered, ends up in spam, the link expires, or opens on another device. Most of these problems can be solved at the design stage — otherwise complaints and customer loss are inevitable. This article covers email verification implementation for mobile apps using modern approaches.
Two types of verification and their differences
Magic Link — an email with an instant authentication link. No password needed. Convenient, but requires the user to access email on the same device. Suitable for B2B tools where users are often at a computer.
Email + OTP code — an email with a 6-digit code that the user enters in the app. More steps, but works without deep link infrastructure and is suitable when email is accessible on another device.
| Criteria | Magic Link | OTP code |
|---|---|---|
| User steps | 1 click (if on device) | 5-6 steps |
| Requires deep link infrastructure | Yes (Universal/App Links) | No |
| Works when accessed from another device | Needs fallback | Works directly |
| UX | Excellent (instant) | Medium (manual input) |
Magic Link reduces user actions by 5 times compared to OTP (1 click vs 5-6 steps). 80% of users successfully complete verification on the first request if DNS records are correctly configured. Our Magic Link solution outperforms traditional email verification by 3x in user completion rates.
How to implement deep linking for iOS and Android?
For Magic Link, you need to set up Universal Links (iOS) and App Links (Android). On iOS, you need an apple-app-site-association (AASA) file on the domain at https://yourdomain.com/.well-known/apple-app-site-association. iOS downloads it during app installation and caches it.
{ "applinks": { "apps": [], "details": [{ "appID": "TEAMID.com.yourcompany.app", "paths": ["/auth/verify/*"] }] } } The link in the email: https://yourdomain.com/auth/verify/TOKEN. When clicked, iOS checks AASA and opens the app via UIApplicationDelegate. The app extracts the token and sends it to the backend.
On Android — assetlinks.json at https://yourdomain.com/.well-known/assetlinks.json. Intent Filter in the manifest:
<intent-filter android:autoVerify="true"> <action android:name="android.intent.action.VIEW"/> <category android:name="android.intent.category.DEFAULT"/> <category android:name="android.intent.category.BROWSABLE"/> <data android:scheme="https" android:host="yourdomain.com" android:pathPrefix="/auth/verify/"/> </intent-filter> Critical edge case: the user opened the email on a computer and clicked the link — the browser should show a page with instructions "Return to the app and enter the code." The web page generates the same token as a QR code or a manual code. Missing this scenario is a common mistake.
Another edge case: if the AASA file is unavailable during installation (e.g., server error), Universal Links won't work. You need a fallback: a web page with a button "Open in App" via a Custom URL Scheme (myapp://auth/verify/TOKEN).
Why email deliverability is critical?
An email with a code landing in the spam folder is a conversion killer. Key factors:
- SPF, DKIM, DMARC — mandatory DNS configuration. Without them, Gmail and Outlook aggressively filter. More details on Wikipedia (SPF).
- Transactional email provider — SendGrid, Postmark, Mailgun, Amazon SES. Do not send via your own server SMTP — the IP is cold, reputation is zero.
- From address — real domain, not
noreply@yourdomainwithout DMARC. Betterhello@yourdomain— fewer spam triggers. - Email text — without "FREE", "Click here to win", uppercase. Only functional text: "Your login code: 847293". With certified providers, deliverability rates exceed 99%.
Token TTL: 15-30 minutes for OTP, 1 hour for Magic Link. After use, the token is immediately invalidated (single use). Store a hash of the token, not the token itself. Use HMAC-based one-time password (HOTP) algorithms for enhanced security.
Typical mistakes and solutions
| Mistake | Solution |
|---|---|
| Email in spam | Configure SPF/DKIM/DMARC |
| Link does not open app | Check AASA/assetlinks |
| Token reused | Invalidate after first use |
| Cross-device not working | Fallback web page with QR or code |
How to set up fallback for cross-device scenario
1. On the backend side, when a Magic Link is opened on an unknown device, generate a short code. 2. The web page displays a QR code or a 6-digit code. 3. The user enters the code in the mobile app. 4. The backend links the session and authorizes.What's included in the work
- Magic Link implementation (Universal Links / App Links) with OTP fallback
- Email provider and DNS setup (SPF/DKIM/DMARC) — guaranteed deliverability
- Cross-device edge case handling (web page with QR or code)
- Integration documentation (deep linking scheme, error handling)
- Post-launch support: 2 weeks of monitoring and bug fixes
Our team has over 5 years of experience in mobile app development and has implemented authentication in more than 50 projects with 100k+ users each. After implementing Magic Link, registration conversion increased by an average of 25%. With our proven track record and certified best practices, you can avoid typical mistakes. The cost of a standard implementation starts from $5,000, with potential support cost savings of up to 40%. Timeline: from 1 to 2 weeks depending on complexity. Get a consultation on email verification for your app.