Magic Link API Examples — Python, Java, C#, Go, PowerShell

Complete, ready-to-run example applications for the Magic Link API are available on GitHub:

mideye/mideye-magic-link-examples Single-file web apps in Python, Java, C#, and Go — passwordless authentication in minutes.

Each example is a complete, single-file web application — enter a phone number, Mideye sends a push notification or SMS magic link, and the user taps Accept or Reject.

Language	Dependencies	Runtime
Python	Flask, Requests	Python 3.8+
Java	None (stdlib only)	Java 17+
C# / .NET	ASP.NET Core Minimal API	.NET 8+
Go	None (stdlib only)	Go 1.21+

---

Quick test from the command line

You don’t need to clone the repository to test the API. Use cURL or PowerShell to send a request directly.

cURL (macOS / Linux)

curl -s -H "api-key: YOUR_API_KEY" \
  "https://mideye.example.com/api/sfwa/auth?msisdn=%2B46701234567"

Tip

The %2B is the URL-encoded + sign. You can also let cURL handle encoding:

curl -s -G -H "api-key: YOUR_API_KEY" \
  --data-urlencode "msisdn=+46701234567" \
  "https://mideye.example.com/api/sfwa/auth"

PowerShell (Windows)

$headers = @{ "api-key" = "YOUR_API_KEY" }
Invoke-RestMethod -Uri "https://mideye.example.com/api/sfwa/auth?msisdn=%2B46701234567" -Headers $headers

Responses

The call blocks until the user responds on their phone or the timeout expires. The three standard outcomes:

{"code":"TOUCH_ACCEPTED"}
{"code":"TOUCH_REJECTED"}
{"code":"USER_NOT_RESPONDED"}

If your server uses a self-signed certificate, add -k to cURL or -SkipCertificateCheck to PowerShell (testing only).

Caution

Never disable TLS verification in production. Import the server’s CA certificate into your trust store instead.

---

What the example apps do

All four examples on GitHub follow the same pattern:

1. Show a login form with a phone number input
2. Call the Magic Link API with the phone number and API key
3. Block while Mideye delivers push notification or SMS to the user
4. Show the result — green for accepted, red for rejected/timeout/error
5. Offer retry on failure

The API call is a single HTTP GET — no SDKs, no complex auth flows, no client-side JavaScript.

Production considerations

The examples are intentionally minimal to demonstrate the API. For production use:

• Store the API key in a secret manager, not in source code
• Add CSRF protection to the form
• Run the API call asynchronously to avoid blocking the web server thread
• Use HTTPS for your application
• Validate and sanitize the phone number input