Email Verification

await auth.requestEmailVerification({
  email: "alice@example.com",
});

This generates a single-use token, hashes it, and sends an email with a verification link. The link points to your app (or to your hosted page if you use hosted links).

Call it after signUpEmailPassword when the application requires email verification:

const { user, session, sessionToken } = await auth.signUpEmailPassword({
  email,
  password,
  name,
});

await auth.requestEmailVerification({ email });

The user is already signed in after sign-up. The application can now show its check-your-email screen.

To send verification emails without configuring your own email provider, follow Cloud email delivery.

When the user opens the link, extract the token and verify it in the backend:

const user = await auth.verifyEmail({
  token: tokenFromUrl,
  sessionToken: existingSessionToken,
});

Own Auth consumes the token and sets user.emailVerifiedAt to the current time. It does not create another session.

Pass the existing session token from trusted request credentials to keep the pending account and its data. The HTTP handler does this automatically. Without proof of the original account, a pending email with earlier credentials or access is claimed by a separate verified user. Use the returned user ID as the result. The earlier account loses this email and its sessions are revoked. The client clears its cached session if the returned user is different. To retain a pending account when opening the link on another device, first sign in to that original account on that device.

Errors

const current = await auth.getCurrentSession(sessionToken);

if (current && !current.user.emailVerifiedAt) {
  // Show a reminder to verify the email address.
}

emailVerifiedAt is null before verification and a Date after successful verification.

Own Auth does not block sign-in for unverified users. The application decides which features require a verified email address.

const current = await auth.getCurrentSession(sessionToken);

if (!current) {
  return redirect("/sign-in");
}

if (!current.user.emailVerifiedAt) {
  return redirect("/verify-email");
}

// Continue with the authenticated request.

Use the same method to send another verification email:

await auth.requestEmailVerification({ email });

Each request creates a separate token that can be used once. Earlier unused links remain valid until use or expiry while the original user still owns the email. Account separation makes its earlier email proofs invalid. Own Auth allows up to five verification email requests per address every ten minutes.

Verification tokens are hashed with the token pepper before storage. The raw token exists only while Own Auth passes it to the email provider. Reading the database does not reveal a usable verification link.

Set up Password reset for users who forget their password, or learn about Sessions.