Verify an email address

PATCH

/email-verifications

Confirms ownership of an email address by consuming the single-use identity-confirmation token that was emailed to the user (typically after signup, or after requesting a re-send via POST /auth/email-verifications). On success, the identity's email-password auth method is permanently marked as verified so the identity can log in with that credential.

The token can only be consumed once — a second attempt with the same value fails with a 400. Tokens also expire; consult the original dispatch flow for the token's lifetime. This endpoint is intentionally unauthenticated: it is designed to be called from the link a user clicks directly in their email client, before they have any session.

Request

Body Params application/jsonRequired

Examples

Responses

🟢200

application/json

The token was valid and unused. The linked email-password auth method has been marked as verified and the identity can now log in with it.

Bodyapplication/json

🟠400

🟠404

🟠409

Request Example

Shell

JavaScript

Java

Swift

curl --location --request PATCH '/email-verifications' \
--header 'Content-Type: application/json' \
--data '{
    "token": "6d20ba1d9c1c4af59ce4f4d84db29ce8269e65fc40a04de498470fe9d54e73e"
}'

Response Example

200 - Success

{
    "message": "Email verified successfully",
    "status": "success",
    "data": {
        "verified": true,
        "identity_id": "01K42YJ0A9Q33E1V25P3X1R7MZ"
    }
}

Modified at 2026-09-28 12:45:48

Request an email verification link

Request a password reset