Sign in with email OTP

MagicMeme login is passwordless. There is no Google button and no password. You (or the human) enter an email, receive a 6-digit code, and verify. The session is a cookie.

MCP catalog tools do not use this flow. They are public. Face swap on the hosted API does: a signed-in, email-verified user for credits, or an agent payment for MPP.

What you will see

1. Open https://magicmeme.com/login. Optional ?callbackUrl= must be a same-origin path (for example /pricing).
2. Enter an email. The app POSTs /api/auth/email-otp/send-verification-otp.
3. Check mail for a 6-digit code. In local dev without Resend, the code logs on the server as [auth-otp].
4. Submit the code. Better Auth sets a session cookie. An anonymous guest session, if you had one, links to that email.
5. The sidebar shows the email and Sign out.

That's the whole human path. Don't paste a token, API key, or password into the agent chat.

Guests

"Continue as guest" on the login page, or POST /api/auth/sign-in/anonymous with JSON {}. Guests get one AI caption batch per UTC day (POST /api/ai/captions returns 429 when exhausted). Signed-in users get starter credits and more caption batches (subject to credit policy).

The captions route creates an anonymous session if none exists. Persist Set-Cookie on follow-up HTTP calls.

Who can call what

• Anyone: catalog (GET /api/memes, MCP search_templates / get_template), hosted MCP connect, fetch llms.txt.
• Guest cookie: one caption batch per UTC day.
• Signed-in user: studio extras, credit checkout, library.
• Signed-in and emailVerified: true: POST /api/ai/face-swap (10 credits).
• Agent with MPP: POST /api/agentic/face-swap after the 402 handshake. No customer OpenRouter key.

GET /api/auth/get-session returns the Better Auth session JSON or null.

Production email

RESEND_API_KEY and EMAIL_FROM must be set, and the sending domain verified in Resend. Misconfiguration fails the send-OTP request instead of pretending success.

Local

http://localhost:3000/login uses the same OTP against your local app. Keep the client on that origin so cookies match.

What to explore next

• Credits for packs and the $0.50 face-swap SKU
• Face swap & MPP for the agent payment rail
• Troubleshooting if the code never arrives