Purpose
Confirms the user’s email address and activates the account.
How It Works
- User receives verification email
- User clicks verification link
- System validates link
- Email is marked verified
Result
- Account is activated
- User can log in
- User is routed based on onboarding status
Validation Rules
- Link must be valid and not expired
- Email must match registered account
Failure Scenarios
- Invalid link
- Expired link
- Email not found
Developer Notes
- Use signed, time-limited verification tokens
- Token must map to the correct user
- Expiration handling required
- Verification should be idempotent
- Update user status to verified
Last modified on June 1, 2026
