Please verify your email address.{' '}
);
}
```
## Resending verification emails
Allow users to request a new verification email, with rate limiting to prevent abuse:
```ts
// POST /api/auth/resend-verification
export async function resendVerification(req, res) {
const session = auth();
const user = await session.user();
if (!user) {
return res.status(401).json({ error: 'Not authenticated' });
}
if (user.emailVerifiedAt) {
return res.json({ message: 'Email is already verified' });
}
// Rate limit by user ID
const result = await resendLimiter.attempt(`resend:${user.id}`);
if (!result.allowed) {
return res.status(429).json({
error: 'Too many requests. Try again later.',
retryAfter: result.resetAt,
});
}
const token = verificationTokens.createToken(String(user.id));
const verifyUrl = `${process.env.APP_URL}/verify-email/${token}`;
await sendEmail({
to: user.email,
subject: 'Verify your email address',
text: `Click here to verify your email: ${verifyUrl}\n\nThis link expires in 24 hours.`,
});
return res.json({ message: 'Verification email sent' });
}
```
## Email change re-verification
When a user changes their email address, reset their verification status and require re-verification:
```ts
// POST /api/auth/change-email
export async function changeEmail(req, res) {
const session = auth();
const user = await session.user();
if (!user) {
return res.status(401).json({ error: 'Not authenticated' });
}
const { newEmail, password } = req.body;
// Verify the current password before allowing an email change
const valid = await hash.verify(password, user.password);
if (!valid) {
return res.status(401).json({ error: 'Invalid password' });
}
// Check if the new email is already taken
const existing = await db.user.findUnique({
where: { email: newEmail.toLowerCase() },
});
if (existing) {
return res.status(400).json({ error: 'Email already in use' });
}
// Update the email and reset verification status
await db.user.update({
where: { id: user.id },
data: {
email: newEmail.toLowerCase(),
emailVerifiedAt: null,
emailChangedAt: new Date(),
},
});
// Send a new verification email
const token = verificationTokens.createToken(String(user.id));
const verifyUrl = `${process.env.APP_URL}/verify-email/${token}`;
await sendEmail({
to: newEmail,
subject: 'Verify your new email address',
text: `Click here to verify your new email: ${verifyUrl}\n\nThis link expires in 24 hours.`,
});
return res.json({ message: 'Email updated. Please verify your new address.' });
}
```
> **Caution**
>
> Setting `emailChangedAt` ensures that any verification tokens sent to the old email address are invalidated. The verification handler checks `iatMs` against `emailChangedAt` to enforce this.
## Database schema
```sql
CREATE TABLE users (
id TEXT PRIMARY KEY,
email TEXT UNIQUE NOT NULL,
password TEXT NOT NULL,
email_verified_at TIMESTAMPTZ,
email_changed_at TIMESTAMPTZ
);
```
## Security checklist
- Use a signed, expiring token (not a random string stored in the database)
- Place the token in the URL path, not the query string
- Set a reasonable expiry (24 hours is typical for verification, shorter for email changes)
- Rate limit resend requests to prevent inbox flooding
- Rate limit the verification endpoint to prevent CPU exhaustion from HMAC computations on invalid tokens
- Invalidate old verification tokens when the email is changed (via `emailChangedAt` + `iatMs` check)
- Require password verification before allowing an email change
- Always lowercase email addresses before storing and comparing
Source: https://ramonmalcolm10.github.io/ideal-auth/guides/email-verification/index.mdx