Just released v0.7.0, with a new com.biffweb/authentication-plugin function that defines routes for email-link and email-code authentication flows. https://github.com/jacobobryant/biff/releases/tag/v0.7.0

Wrote a little announcement post which goes into the idea of plugins a bit more: https://biffweb.com/p/secrets-auth-plugins/