Your AI writes the code.
This is the 30% it gets wrong.

// app/api/auth/magic/route.ts
export async function POST(req: Request) {
  const { email } = await req.json();
  const token = randomToken(32);

  // single-use, 15-min expiry, hashed at rest
  await db.magicLink.create({ data: {
    emailHash: hash(email),
    tokenHash: hash(token),
    expiresAt: minutes(15),
  }});

  await sendMagicEmail(email, token);
  return Response.json({ ok: true }); // never reveal if email exists
}

# app/controllers/magic_links_controller.rb
class MagicLinksController < ApplicationController
  def create
    token = SecureRandom.hex(32)

    # single-use, 15-min expiry, hashed at rest
    MagicLink.create!(
      email_hash: Digest(params[:email]),
      token_hash: Digest(token),
      expires_at: 15.minutes.from_now
    )

    MagicMailer.link(params[:email], token).deliver_later
    render json: { ok: true } # no enumeration
  end
end

// routes / MagicLinkController.php
public function store(Request $req) {
  $token = Str::random(64);

  // single-use, 15-min expiry, hashed at rest
  MagicLink::create([
    'email_hash' => hash('sha256', $req->email),
    'token_hash' => Hash::make($token),
    'expires_at' => now()->addMinutes(15),
  ]);

  Mail::to($req->email)->send(new MagicLink($token));
  return response()->json(['ok' => true]);
}