The links are one-time use so you need to take this into account anyway or users simply can't login. It's usually done with a required button click after follow

The links are one-time use so you need to take this into account anyway or users simply can't login. It's usually done with a required button click after following the magic link. Or you can try JavaScript techniques to detect a real browser.