Email verification

Email verification confirms that the user owns the email address.

Modes

Turn this on in Project settings → Authentication.

Effects:

Signup returns 202 with code: "email_verification_required" when verification is still open
Sign-in returns 403 with the same code when the email is not verified
Refresh returns 403 when the email is not verified
Elmapi sends a verification email on signup

Signup still sends a verification email. Users can sign in before they verify. Use this when you want verification later in the product flow.

Elmapi emails a link in this shape:

{verification_url_base}/auth/verify-email?token=TOKEN&project_id=PROJECT_UUID

verification_url_base comes from project email settings or from PROJECT_AUTH_VERIFICATION_URL_BASE.

Point that base URL at your frontend route when your app hosts the confirm page. Then call POST /api/auth/verify-email/confirm with the token.

[POST] /auth/verify-email/resend

Body:

{
  "email": "[email protected]"
}

The response is enumeration-safe. It does not reveal whether the email exists.

[POST] /auth/verify-email/confirm

Body:

{
  "token": "VERIFICATION_TOKEN"
}

Success returns the user object. Invalid or expired tokens return 422.

You can edit subject, heading, intro, button text, outro, and from details in the dashboard. Env defaults also exist. See Configuration.

Setting	Default
Token lifetime	60 minutes
Resend cooldown	60 seconds