Verify Email

​

Overview

​

Request

​

Body Parameters

​

Response

​

Status Codes

• 200 OK - Email successfully verified
• 400 Bad Request - Invalid or missing verification token, or user not found

​

Examples

curl -X POST https://your-domain.com/api/auth/verify \
  -H "Content-Type: application/json" \
  -d '{
    "verificationToken": "a1b2c3d4e5f6g7h8i9j0k1l2m3n4o5p6"
  }'

​

Success Response (200)

{
  "verified": true,
  "user": {
    "email": "[email protected]",
    "username": "Alice Johnson"
  }
}

​

Error Responses (400)

{
  "error": "Invalid verification token"
}

{
  "error": "No User found."
}

{
  "error": "Error Verifying email."
}

​

Error Cases

​

Common Error Scenarios

1. Missing Verification Token
   • Status: 400
   • Message: “Invalid verification token”
   • Cause: verificationToken not provided in request body or is empty
2. Invalid Token
   • Status: 400
   • Message: “No User found.”
   • Cause: No user exists with the provided verification token (token may be incorrect, already used, or expired)
3. Already Verified
   • Status: 400
   • Message: “No User found.”
   • Cause: User has already verified their email (token was set to null after verification)
4. Database Error
   • Status: 400
   • Message: “Error Verifying email.”
   • Cause: Exception during database query or update operation

​

Implementation Details

​

Verification Process

1. Token Lookup: System searches for a user with the matching verificationToken
2. User Update: If found, updates the user record:
   • Sets emailVerified to true
   • Sets verificationToken to null
3. Response: Returns verification status and user information

​

Database Changes

{
  emailVerified: true,      // Changed from false
  verificationToken: null   // Cleared to prevent reuse
}

​

Integration Example

​

Complete Registration Flow

// Step 1: Sign up
const signupResponse = await fetch('/api/auth/signup', {
  method: 'POST',
  headers: { 'Content-Type': 'application/json' },
  body: JSON.stringify({
    email: '[email protected]',
    name: 'Alice Johnson',
    password: 'SecurePass123!',
  }),
});

const { verificationToken } = await signupResponse.json();

// Step 2: Send verification email (implement your email service)
await sendVerificationEmail('[email protected]', verificationToken);

// Step 3: User clicks verification link, extract token from URL
const urlParams = new URLSearchParams(window.location.search);
const token = urlParams.get('token');

// Step 4: Verify email
const verifyResponse = await fetch('/api/auth/verify', {
  method: 'POST',
  headers: { 'Content-Type': 'application/json' },
  body: JSON.stringify({ verificationToken: token }),
});

const result = await verifyResponse.json();
if (result.verified) {
  // Step 5: Redirect to sign in
  window.location.href = '/signin';
}

​

Best Practices

​

Next Steps

1. User can now sign in with full account access
2. The isEmailVerified flag in their session will be true
3. Access to email-verified-only features is granted