# Sharing sites with magic authentication

Magic authentication asks every visitor of your shared site for their email address before they can see it. You decide which addresses get in: anyone, everyone from your company's email domain, or a list of specific people.

Visitors see a login page in their browser instead of a basic authentication popup, which makes it a friendly way to share a staging site or a work in progress with a client or your team.

## Require an email address

To ask visitors for an email address and accept any valid one, add `--magic-auth`:

```bash
expose share my-site.test --magic-auth
```

When you share a site from its project directory, the option works the same way:

```bash
expose --magic-auth
```

## Choose who gets in

Pass a comma-separated list of the addresses to accept. An entry that starts with `@` accepts every address at that domain, and any other entry accepts exactly that address:

```bash
# Everyone with a @company.com address
expose share my-site.test --magic-auth=@company.com

# Two email domains
expose share my-site.test --magic-auth=@company.com,@agency.com

# Specific people
expose share my-site.test --magic-auth=alice@example.com,bob@example.com

# Your team and one client
expose share my-site.test --magic-auth=@company.com,client@example.com
```

Expose compares addresses without regard to case. A domain entry only matches that exact domain, so `@company.com` accepts `jane@company.com` but not `jane@mail.company.com`.

Once the share is running, the connection table shows which addresses are accepted:

```
Shared site              my-site.test
Dashboard                http://127.0.0.1:4040
Public URL               https://my-site.sharedwithexpose.com
Magic Auth               Enabled (@company.com, client@example.com)
```

## What visitors see

![The Access Required page of Expose asking a visitor for their email address before they can continue to the shared site](https://expose.dev/img/docs/expose/img/magic-auth-login.webp)

1. A visitor opens your shared URL and sees an "Access Required" page that asks for their email address.
2. If the address isn't valid or isn't on your list, the page tells them and they can try again.
3. If it is accepted, Expose sets a cookie and sends them on to the page they first asked for.

The cookie keeps them signed in for 7 days. Visitors have to enter their email address again when you restart Expose, because each Expose session signs its cookies with a new key.

## Security

Expose doesn't send an email to the address a visitor enters, so it can't confirm that the address belongs to them. Anyone who knows or guesses an accepted address can open the site. Use magic authentication to keep a shared site away from people who stumble on its URL, and add a password with [basic authentication](https://expose.dev/docs/client/basic-authentication) when that isn't enough.

If you pass both `--basicAuth` and `--magic-auth`, visitors need the password first and then an accepted email address.

## Combining with other options

Magic authentication works together with the other options of `expose share`:

```bash
# A custom subdomain
expose share my-site.test --subdomain=demo --magic-auth=@company.com

# A custom domain
expose share my-site.test --domain=mycompany.com --magic-auth

# A share on your local network
expose share my-site.test --lan --magic-auth=@company.com
```

Magic authentication needs Expose 3.2 or later. `expose catch-all` and `expose share-port` don't take the option.