Email Verification

await auth.requestEmailVerification({
  email: "alice@example.com",
});

This generates a single-use token, hashes it, and sends an email with a verification link. The link points to your app (or to your hosted page if you use hosted links).

Call it after signUpEmailPassword when the application requires email verification:

const { user, session, sessionToken } = await auth.signUpEmailPassword({
  email,
  password,
  name,
});

await auth.requestEmailVerification({ email });

The user is already signed in after sign-up. The application can now show its check-your-email screen.

When the user opens the link, extract the token and verify it in the backend:

const user = await auth.verifyEmail({
  token: tokenFromUrl,
});

Own Auth consumes the token and sets user.emailVerifiedAt to the current time. It does not create another session.

Errors

const current = await auth.getCurrentSession(sessionToken);

if (current && !current.user.emailVerifiedAt) {
  // Show a reminder to verify the email address.
}

emailVerifiedAt is null before verification and a Date after successful verification.

Own Auth does not block sign-in for unverified users. The application decides which features require a verified email address.

const current = await auth.getCurrentSession(sessionToken);

if (!current) {
  return redirect("/sign-in");
}

if (!current.user.emailVerifiedAt) {
  return redirect("/verify-email");
}

// Continue with the authenticated request.

Use the same method to send another verification email:

await auth.requestEmailVerification({ email });

Each request creates a new single-use token. Earlier unused links remain valid until they are used or reach their expiry time. Own Auth allows up to five verification-email requests per address every ten minutes.

Verification tokens are hashed with the token pepper before storage. The raw token exists only while Own Auth passes it to the email provider. Reading the database does not reveal a usable verification link.

Set up Password reset for users who forget their password, or learn about Sessions.