---
title: Generate Magic Login URL
description: "Returns a short-lived URL that logs the WordPress admin into the site's /wp-admin dashboard without a password. Token TTL is 10 minutes. Synchronous — the first call uploads the xCloud…"
url: "https://betterdocs.shahrear.msf.bd/index.php/docs/hell0-boys-docs/hell0-boys/wordpress-actions/generate-magic-login-url/"
updated: "2026-08-20"
category: hell0 boys / WordPress Actions
---

# Generate Magic Login URL

POST`/sites/{uuid}/magic-login`

## Code Samples

```curl

                curl --request POST \
  --url 'https://app.xcloud.host/api/v1/sites/{uuid}/magic-login' \
  --header 'Authorization: Bearer YOUR_TOKEN' \
  --header 'Content-Type: application/json' \
  --data '{
    "login_as": "editor_user"
}'

                const response = await fetch('https://app.xcloud.host/api/v1/sites/{uuid}/magic-login', {
  method: 'POST',
  headers: {
    'Authorization': 'Bearer YOUR_TOKEN',
    'Content-Type': 'application/json'
  },
  body: JSON.stringify({
    "login_as": "editor_user"
})
});

const data = await response.json();
console.log(data);

                import requests

headers = {
    "Authorization": "Bearer YOUR_TOKEN",
    "Content-Type": "application/json"
}

payload = {
    "login_as": "editor_user"
}

response = requests.post("https://app.xcloud.host/api/v1/sites/{uuid}/magic-login", headers=headers, json=payload)

print(response.json())

                <?php
$curl = curl_init();

curl_setopt_array($curl, [
  CURLOPT_URL => 'https://app.xcloud.host/api/v1/sites/{uuid}/magic-login',
  CURLOPT_RETURNTRANSFER => true,
  CURLOPT_CUSTOMREQUEST => 'POST',
  CURLOPT_HTTPHEADER => [
  'Authorization: Bearer YOUR_TOKEN',
  'Content-Type: application/json'
  ],
  CURLOPT_POSTFIELDS => '{
    "login_as": "editor_user"
}',
]);

$response = curl_exec($curl);
curl_close($curl);

echo $response;

                using System.Net.Http;
using System.Text;

var client = new HttpClient();
var request = new HttpRequestMessage(new HttpMethod("POST"), "https://app.xcloud.host/api/v1/sites/{uuid}/magic-login");
request.Headers.Add("Authorization", "Bearer YOUR_TOKEN");
request.Content = new StringContent(@"{
    ""login_as"": ""editor_user""
}", Encoding.UTF8, "application/json");
var response = await client.SendAsync(request);
var body = await response.Content.ReadAsStringAsync();
Console.WriteLine(body);

                import java.net.URI;
import java.net.http.*;

HttpClient client = HttpClient.newHttpClient();
HttpRequest request = HttpRequest.newBuilder()
    .uri(URI.create("https://app.xcloud.host/api/v1/sites/{uuid}/magic-login"))
    .header("Authorization", "Bearer YOUR_TOKEN")
    .header("Content-Type", "application/json")
    .method("POST", HttpRequest.BodyPublishers.ofString("""
{
    "login_as": "editor_user"
}
"""))
    .build();

HttpResponse<String> response = client.send(request, HttpResponse.BodyHandlers.ofString());
System.out.println(response.body());
```

## Response

```json

                {
    "success": true,
    "message": "Magic login URL generated",
    "data": {
        "url": "https://example.com/wp-admin/wp-login.php?xcloud_magic_login_token=eyJ...&auth_token=Xa3p9q&v=1742212211",
        "expires_at": "2026-05-20T14:50:00Z",
        "admin_user": "admin"
    }
}

                {
    "success": false,
    "message": "Unauthenticated.",
    "data": null
}

                {
    "success": false,
    "message": "An error occurred.",
    "data": null
}

                {
    "success": false,
    "message": "Not found.",
    "data": null
}

                {
    "success": false,
    "message": "An error occurred.",
    "data": null
}

                {
    "success": false,
    "message": "An error occurred.",
    "data": null
}

                {
    "success": false,
    "message": "An error occurred.",
    "data": null
}

                {
    "success": false,
    "message": "An error occurred.",
    "data": null
}
```

Returns a short-lived URL that logs the WordPress admin into the site's `/wp-admin` dashboard without a password. Token TTL is 10 minutes. Synchronous — the first call uploads the xCloud magic-login WP plugin over SSH (subsequent calls skip when plugin status is healthy). Rate-limited to 30 requests per minute per user. Requires the `write:sites` scope and the `site:magic-login` permission. Delegated logins (`login_as`) additionally require the `site:access-magic-login` [Team](https://betterdocs.shahrear.msf.bd/encyclopedia/team/) permission.

## Path Parameters

| Name | Type | Required | Description |
| --- | --- | --- | --- |
| `uuid` | string (uuid) | **Required** | UUID of the site |

## Request Body

Content type: `application/json`

| Field | Type | Required | Description |
| --- | --- | --- | --- |
| `login_as` | string | Optional | Optional WordPress username to log in as. When omitted, logs in as the site's admin user. Requires the caller's [Team](https://betterdocs.shahrear.msf.bd/encyclopedia/team/) membership to grant the \`site:access-magic-login\` permission. |

```json

                {
    "login_as": "editor_user"
}
```

## Responses

### 200 — Magic login URL generated

| Field | Type | Required | Description |
| --- | --- | --- | --- |
| `success` | boolean | Optional |  |
| `message` | string | Optional |  |
| `data` | object | Optional |  |
| `data` | object | Optional |  |
| `data.url` | string (uri) | Optional | Short-lived URL that logs the WordPress admin in without a password. Open in a browser to land on /wp-admin. Valid for 10 minutes from creation. |
| `data.expires_at` | string (date-time) | Optional | ISO 8601 timestamp at which the URL stops being valid. |
| `data.admin_user` | string | Optional | WordPress username that the URL will log in as. Equals the site's admin user unless \`login_as\` was passed. |

```json

                {
    "success": true,
    "message": "Magic login URL generated",
    "data": {
        "url": "https://example.com/wp-admin/wp-login.php?xcloud_magic_login_token=eyJ...&auth_token=Xa3p9q&v=1742212211",
        "expires_at": "2026-05-20T14:50:00Z",
        "admin_user": "admin"
    }
}
```

### 401 — Missing or invalid authentication token

| Field | Type | Required | Description |
| --- | --- | --- | --- |
| `success` | boolean | Optional |  |
| `message` | string | Optional |  |
| `data` | object | Optional |  |

```json

                {
    "success": false,
    "message": "Unauthenticated.",
    "data": null
}
```

### 403 — Forbidden — caller lacks site:magic-login or delegation permission

| Field | Type | Required | Description |
| --- | --- | --- | --- |
| `success` | boolean | Optional |  |
| `message` | string | Optional |  |
| `data` | object | Optional |  |

```json

                {
    "success": false,
    "message": "An error occurred.",
    "data": null
}
```

### 404 — Resource not found or not accessible to your [Team](https://betterdocs.shahrear.msf.bd/encyclopedia/team/)

| Field | Type | Required | Description |
| --- | --- | --- | --- |
| `success` | boolean | Optional |  |
| `message` | string | Optional |  |
| `data` | object | Optional |  |

```json

                {
    "success": false,
    "message": "Not found.",
    "data": null
}
```

### 422 — Site is not WordPress, or magic login is disabled on the [Server](https://betterdocs.shahrear.msf.bd/encyclopedia/server/)

| Field | Type | Required | Description |
| --- | --- | --- | --- |
| `success` | boolean | Optional |  |
| `message` | string | Optional |  |
| `data` | object | Optional |  |

```json

                {
    "success": false,
    "message": "An error occurred.",
    "data": null
}
```

### 429 — Rate limit exceeded (30/min/user)

| Field | Type | Required | Description |
| --- | --- | --- | --- |
| `success` | boolean | Optional |  |
| `message` | string | Optional |  |
| `data` | object | Optional |  |

```json

                {
    "success": false,
    "message": "An error occurred.",
    "data": null
}
```

### 502 — Failed to provision magic login plugin on the site

| Field | Type | Required | Description |
| --- | --- | --- | --- |
| `success` | boolean | Optional |  |
| `message` | string | Optional |  |
| `data` | object | Optional |  |

```json

                {
    "success": false,
    "message": "An error occurred.",
    "data": null
}
```

### 503 — [Server](https://betterdocs.shahrear.msf.bd/encyclopedia/server/) is not connected

| Field | Type | Required | Description |
| --- | --- | --- | --- |
| `success` | boolean | Optional |  |
| `message` | string | Optional |  |
| `data` | object | Optional |  |

```json

                {
    "success": false,
    "message": "An error occurred.",
    "data": null
}
```