Magic link security review cost: $2,400, you own it

Magic link security review cost is $2,400 once for one app whose users sign in by clicking a one-time email link. $1,200 starts the work. The report is due 48 hours after that test login works. You own the PDF. There is no subscription.

The link is a password that dies. Your API decides whether a second click, a long life, or a landing page you do not own still creates a session.

Short answer: Magic link security review cost is $2,400 once, with $1,200 to start, for one app that signs people in from an email link. I check that the link dies after one success, how long it stays valid, and what session the API issues, then write the report 48 hours after access works. You own it. A vendor’s magic-link product and a multi-week accredited pentest are different purchases. The offer is the web application security review.

What does a magic link security review cost?#

$2,400 once for one app, $1,200 to start, the rest when the PDF lands. You own that file. You are not buying a Clerk or Stytch seat, a monthly login add-on, or a certificate I do not hold.

The table uses published lifetimes, not guesses. Clerk’s sign-in options expire an email link in 10 minutes. Clerk sign-in tokens last 30 days by default and work once. Stytch’s overview is one-time use. Stytch’s login configuration defaults login links to 60 minutes and consumer signup links to 7 days. That is their product, not your API.

What you are buying	2026 price	What you actually get
Clerk email verification link	Expires in 10 minutes	Their control. Not a test of your API
Clerk sign-in token	One-time, 30 days by default	A long-lived email link you can mint. Still their product
Stytch login magic link	60 minutes default, one-time	Their product. A scanner click should not mint a session
This review	$2,400 once, $1,200 to start	One app, the email link and the session it creates, report in 48 hours, one retest
Small web app, market	$2,500–$15,000, or $2,500–$5,500	Longer calendar, often a wider app than the login link

WardenBit’s 2026 small-business guide puts most web app projects between $2,500 and $15,000, and $100–$3,000 as mostly automated scanning. Pentestica’s price guide, updated 2 October 2026, lists a manual web application or API test at $2,500–$5,500.

Two passes of this review, a year apart, are $4,800 over 24 months. Three are $7,200 over 36 months. You are not renting the PDF.

The same $2,400 is on pricing. If the product is a SaaS app with customer accounts, the industry page is website security review for SaaS. A callback-URI pass is a different writeup: OAuth redirect security review cost.

What does that $2,400 actually check?#

I request the email link on a test account you give me, use it once, and record what the API accepts. The pass covers the live login, the link, and the session those pages already create. I do not ship a recipe for forging one.

Clerk also documents a setting that requires the link to be opened on the same device and browser that started sign-in. Stytch says an email-security scanner must not consume the token or receive a session. A homegrown link often skips both, and the owner still calls it “the magic link.”

I record, in plain findings:

• How long a fresh link still works, against the lifetime you think you set.
• Whether a second click after a successful login creates another session.
• Whether the link lands on a URL your app owns.
• Whether “send the link” answers differently for an address that is not a user.
• Which account, role, and tenant the API attaches after one good click.

The document shape is the sample pentest report. No client names. No exploit steps.

What is not included for $2,400?#

You get severity, path, role, and a fix an engineer can ticket, for one authorized app. I do not ship exploit steps, a Clerk or Auth0 product audit, a second app, or a certificate I do not hold. The PDF is yours. There is no monthly fee.

This is not a Stytch dashboard review. If login is Stytch and the question is the whole session, that is the Stytch security review cost post, not this one. A refresh token that mints new access tokens is a later pass, not this price.

This is not AI Front Door, where a customer books or pays from ChatGPT, Claude, Grok, or another AI app that supports MCP connectors. MCP is the open standard those apps use to connect to a business’s tools. It is not Workflow Automation either. That offer is $3,500 once for one repeating ops job, such as an invoice chase, and it does not test an email link.

How does the review run from the email link to the PDF?#

You authorize one URL, I use the test account you send, and the clock starts when I can request the link. Your API decides whether it believes the click. The PDF is what you keep. I do not patch production inside this price.

Step	What happens
Trigger	Users already sign in from an email link, or a buyer asked how long that link lives
Action	I request a link, use it once, and compare that session to the API the login page already calls
System of record	The app, plus the written findings: severity, path, role, fix
Human escalation	You ticket the change. I do not edit production inside this price

Send written authorization and one test user that can receive the link. Say whether a second tenant must stay closed. Name the engineer who owns the API. One free retest of that same URL is included within 14 days.

When this isn’t the right move yet#

Do not pay the $1,200 if nobody can sign in from an email link today, or if I cannot legally open the app. A pass with no link is a normal login skim. Ship the link, then book the review.

Wait if the flow is still a ticket. Hire the firm that holds CREST if the questionnaire requires that name. If the only question is the OAuth callback, read the redirect post instead of buying this one twice. A missed phone is the receptionist, $8,000 once, not this review.

What should be true before I start?#

Bring the URL, one test user, and one sentence on how long you believe the link lives. I can start without a tour of your email vendor. I cannot start without a login that behaves like production.

Before you pay, write the list:

• The lifetime you intend, in minutes, for both new signups and returning users.
• Whether a second click must fail.
• The URL the link is allowed to open, and the URLs it must not.
• The role and tenant that one good click may enter.

If you want the layout before credentials, ask for the sample from the contact form.

$1,200 reserves the work on the review page. I confirm scope in writing before I start. The form is short. I reply with the replacement map within 24 hours. If you would rather talk through the workflow for 20 minutes and see whether this fits, book a 20-minute call.