Re-sends the email verification code for a registered email-password auth method that has not yet been verified. Use this when the original confirmation email sent at registration expired, was lost, or never arrived.A brand-new single-use identity-confirmation token is generated and the previous one is invalidated — only the most recently issued code will verify successfully. Email delivery is asynchronous: a successful 200 response only confirms the resend was accepted, not that the email has been delivered.To prevent account enumeration, this endpoint always responds with the same generic 200/{ "pending": true } result regardless of whether the email address belongs to a real account, whether that account is an email-password auth method, or whether it has already been verified — no information about account existence or verification state is ever leaked through the response.Resending is rate-limited per account: at most one resend every 5 minutes, and at most 10 resends within a rolling period before the account is locked out of resending for 24 hours (after which the count resets). These per-account limits only produce a distinct 429/403 response when the target account genuinely exists and is unverified — unknown or already-verified emails always receive the generic 200. Requests are also rate-limited per source IP address, independently of the target email and regardless of whether it belongs to a real account: at most 20 resend requests per calling IP within a rolling 1-hour window, to guard against enumeration/scanning across many different addresses.This endpoint is unauthenticated — the caller has no JWT at this point in the registration flow, so it is keyed entirely by the email in the request body.
Request
Body Params application/jsonRequired
Examples
Responses
🟢200
application/json
The resend request was accepted. If the email belongs to a real, unverified email-password account and it is not currently rate-limited, a new confirmation email has been queued for delivery. This response is always returned in this generic form, even for unknown or already-verified emails, to prevent account enumeration.