@@ -0,0 +1,11 @@
+---
+'@objectstack/plugin-auth': patch
+---
+
+fix(plugin-auth): the Magic Link mail states the lifetime the link really has, five minutes
+
+Clause-②: no
+
+Metadata-protocol: none
+
+The `auth.magic_link` mail said "This link expires in 10 minutes", while the link it carried lived 300 seconds: `magicLink()` was mounted without `expiresIn`, so better-auth's own default applied, and the mail's `expiresInMinutes` was a separate hard-coded `10`. The mount now states `expiresIn: 300` explicitly, and the mail's `expiresInMinutes` is derived from that same value, so every locale of the mail now reads "5 minutes". The link's lifetime does not change. Nothing to do on upgrade; a customised `auth.magic_link` template that hard-codes its own number should read `expiresInMinutes` instead.
@@ -1052,7 +1052,19 @@ describe("#15106 — the magic link reads the recipient's own sys_user.locale",
     expect(sent[0].to).toBe('ada@example.com');
     expect(sent[0].data.magicLinkUrl).toBe('http://x/magic');
     expect(sent[0].data.token).toBe('t');
-    expect(sent[0].data.expiresInMinutes).toBe(10);
+    expect(sent[0].data.expiresInMinutes).toBe(5);
+  });
+
+  it('the mail states the lifetime the mount gives the link, from one source', async () => {
+    // The copy reads "expires in N minutes"; the link lives the mount's
+    // `expiresIn` seconds. Both must be the same number, and the mount must
+    // state it rather than lean on the vendor default (300 s today), which a
+    // dependency bump could move under the mail.
+    const { capturedConfig } = await boot('es-ES');
+    const magic = capturedConfig.plugins.find((p: any) => p.id === 'magic-link');
+    expect(magic._opts.expiresIn).toBe(300);
+    const sent = await driveMagicLink({ deployment: 'es-ES' });
+    expect(sent[0].data.expiresInMinutes * 60).toBe(magic._opts.expiresIn);
   });
 
   it('a placeholder address is still refused BEFORE any recipient read', async () => {
 
@@ -4216,7 +4216,18 @@ export class AuthManager {
       await this.addOptionalPlugin(plugins, 'magicLink', async () => {
       const { magicLink } = await import('better-auth/plugins/magic-link');
       // magic-link reuses the `verification` table — no extra schema mapping needed.
+      //
+      // The link's lifetime, in seconds, and the ONE source for it: the mount
+      // states it and the mail's `expiresInMinutes` is derived from it, so the
+      // copy says what the link does. 300 s is the lifetime the link already
+      // had through the vendor default (`opts.expiresIn || 300`, better-auth
+      // 1.7.12 `plugins/magic-link/index.mjs`), now written down so a
+      // dependency bump cannot move it under the mail. ⛔ Lengthening it
+      // relaxes a sign-in credential's validity — a security-boundary change
+      // for the maintainer, not a copy fix.
+      const magicLinkExpiresInSec = 5 * 60;
       return magicLink({
+        expiresIn: magicLinkExpiresInSec,
         // #14319 — this one is called with the endpoint CTX, not a Request
         // (measured; magic-link/index.mjs `sendMagicLink({...}, ctx)`).
         sendMagicLink: async ({ email: recipientEmail, url, token }, ctx?: unknown) => {
@@ -4280,7 +4291,7 @@ export class AuthManager {
               data: {
                 magicLinkUrl: url,
                 token,
-                expiresInMinutes: 10,
+                expiresInMinutes: Math.round(magicLinkExpiresInSec / 60),
                 appName: this.getAppName(),
               },
               // [ADR-0131 D7, Q2 A] A sign-in link for a person: identity mail.