Email Verification
Learn more about the email verification process.
Email verification is a process in which a new user must validate ownership of their email inbox before they can access the application, ensuring authenticity of inbox ownership.
Verification is a two-step process:
- A user signs up to your application and an email is sent with a verification code.
- The user inputs the verification code to complete the signup process.
This applies to all authentication methods including OAuth and SSO. This unifying interface simplifies how your application considers the authenticity of your users.
Email verification is always on to ensure that verified users are always returned to your application.
Users signing in with SSO with a verified domain are automatically considered verified and do not need to complete the email verification process.
An invitation link is delivered by email, so accepting one proves ownership of the invited inbox. New users who sign up with the exact email address the invitation was sent to, within 10 minutes of the invitation email being sent, are automatically considered verified and are not sent a separate verification email. Resending an invitation restarts the 10 minute window.
An authentication.email_verification_succeeded event is emitted in this case, but no email_verification.created event, since no verification code is created.
The user completes the usual email verification process if the invitation is accepted after that window, if the invitation was never sent by email, or if they sign up with a different email address than the one that was invited.
AuthKit automatically handles email verification out of the box. When a user signs up via the hosted signup form, AuthKit will automatically send the verification email, prompt the user to input the code and route them through the authentication process before they gain access to the application. If desired, you can send these emails yourself.
If a verification email bounces or is blocked, the recipient’s address may be added to your provider’s suppression list, preventing future deliveries. See Check suppression status to check and resolve suppressions.