I spent hours figuring this out. Posting it here so someone else can find it.
If you create an API workflow that generates a magic link, the link will only work if the API workflow was triggered inside a Bubble session (i.e.: an browser page).
If you trigger the API workflow with webhook, the link will still send and be clickable, but the user will not be logged in.
You can replicate this by logging out your test user sessions, then triggering the API workflow from Postman or a webhook.
None of this is noted in the manual and the behaviour is tricky to troubleshoot.
webhook API worklfow magic link not working broken