Email Verification

AuthFort provides email verification to confirm user email ownership. The flow is programmatic — you control how to deliver verification tokens (email, etc.). AuthFort never sends emails directly.

Verification Flow

1. Generate a verification token

   token = await auth.create_email_verification_token(user_id)
   # Returns token string, or None if already verified / user not found

   token = await auth.create_email_verification_token(user_id)
   # Returns token string, or None if already verified / user not found

   Returns a random token string, or None if the user is already verified or not found.

2. Deliver the token

   Register an event hook to deliver the token. AuthFort doesn’t send emails.

   @auth.on("email_verification_requested")
   async def send_verification(event):
       await send_email(
           to=event.email,
           body=f"https://myapp.com/verify?token={event.token}",
       )

   @auth.on("email_verification_requested")
   async def send_verification(event):
       await send_email(
           to=event.email,
           body=f"https://myapp.com/verify?token={event.token}",
       )

   Always return a success response to your client regardless of the result to prevent email enumeration.

3. Verify the email

   Via the built-in endpoint:

   POST /auth/verify-email
   Content-Type: application/json
   
   {"token": "..."}

   POST /auth/verify-email
   Content-Type: application/json
   
   {"token": "..."}

   Or programmatically:

   result = await auth.verify_email(token)
   # Returns True, raises AuthError if invalid/expired

   result = await auth.verify_email(token)
   # Returns True, raises AuthError if invalid/expired

How It Works

Tokens are single-use and expire after email_verify_ttl seconds (default: 24 hours). After successful verification, the user’s email_verified field is set to True.

Note

Magic links and email OTP also verify the email automatically — no separate verification step needed if you use those flows.

Events

Emits email_verification_requested (includes token for delivery) and email_verified events.

See Events & Hooks for all events and their payloads.