Generate customer portal magic link

Magic Link Features:

• Passwordless Access: No login credentials required, link serves as authentication
• Time-Limited: Link expires after configured duration (typically 24-72 hours)
• Single Customer: Link is bound to specific customer ID, cannot be reused for others
• Secure Token: Uses cryptographically secure JWT tokens for authentication
• Customer Portal: Directs to full-featured self-service subscription portal

Returned Information:

• Magic Link URL: Full URL to customer portal with embedded authentication token
• Token: JWT token value (can be used separately if needed)
• Expiration Time: When the magic link will expire (ISO 8601 format)
• Customer ID: Shopify customer ID the link is generated for
• Shop Domain: Store domain where subscriptions are hosted

Customer Portal Capabilities (via Magic Link):

• View all active and paused subscription contracts
• Update shipping address for upcoming deliveries
• Change payment method for future billing
• Pause or resume subscription deliveries
• Skip upcoming delivery orders
• Modify delivery frequency (e.g., monthly to bi-monthly)
• Add or remove products from subscription
• Swap product variants (size, flavor, color)
• Cancel subscription with reason feedback
• View order history and upcoming deliveries
• Apply discount codes to subscription

Common Use Cases:

• Send magic link via email for customer self-service
• Include link in transactional emails (order confirmation, shipping notices)
• Customer support: provide link to customers over phone/chat
• Embed link in customer account page or dashboard
• Automated email campaigns for subscription management reminders
• Post-purchase flows to encourage subscription modifications
• Win-back campaigns: send magic link to cancelled/paused customers

Security Notes:

• Links are single-use per session (new token generated each time)
• Tokens include shop and customer validation to prevent tampering
• Expired links automatically redirect to token request page
• Links should be sent via secure channels (HTTPS, encrypted email)

Integration Best Practices:

• Always send magic links via email or SMS (don’t display on public pages)
• Set appropriate expiration time based on use case
• Include clear call-to-action in emails (“Manage Your Subscription”)
• Handle expired tokens gracefully with re-send functionality
• Track magic link generation for security audit logs

Authentication: Requires API key authentication via X-API-Key header or api_key parameter