/
Contact usSee pricingStart building
Node
​

    About Stytch

    Introduction
    Integration Approaches
      Full-stack overview
      Frontend (pre-built UI)
      Frontend (headless)
      Backend
    Migrations
      Migration overview
      Migrating users statically
      Migrating users dynamically
      Additional migration considerations
      Zero-downtime deployment
      Defining external IDs for users
      Exporting from Stytch
    Custom Domains
      Overview

    Authentication

    DFP Protected Auth
      Overview
      Setting up DFP Protected Auth
      Handling challenges
    Magic Links
    • Email Magic Links

      • Getting started with the API
        Getting started with the SDK
        Replacing your password reset flow
        Building an invite user flow
        Add magic links to an existing auth flow
        Adding PKCE to a Magic Link flow
        Magic Link redirect routing
    • Embeddable Magic Links

      • Getting started with the API
    MFA
      Overview
      Backend integration
      Frontend integration
    Mobile Biometrics
      Overview
    M2M Authentication
      Authenticate an M2M Client
      Rotate client secrets
      Import M2M Clients from Auth0
    OAuth
    • Identity providers

      • Overview
        Provider setup
      Getting started with the API (Google)
      Add Google One Tap via the SDK
      Email address behavior
      Adding PKCE to an OAuth flow
    Connected AppsBeta
      Setting up Connected Apps
      Client types
    • Integration Guides

      • Integrate with AI agents
        Integrate with MCP servers
        Integrate with CLI Apps
    • Resources

      • About Remote MCP Servers
        Consent Management
    Passcodes
      Getting started with the API
      Getting started with the SDK
    • Toll fraud

      • What is SMS toll fraud?
        How you can prevent toll fraud
      Unsupported countries
    Passkeys & WebAuthn
    • Passkeys

      • Passkeys overview
        Set up Passkeys with the frontend SDK
    • WebAuthn

      • Getting started with the API
        Getting started with the SDK
    Passwords
      Getting started with the API
      Getting started with the SDK
      Password strength policy
    • Email verification

      • Overview
        Email verification before password creation
        Email verification after password creation
    Sessions
      How to use sessions
      Backend integrations
      Frontend integrations
      Custom claims
      Custom claim templates
      Session tokens vs JWTs
      How to use Stytch JWTs
    TOTP
      Getting started with the API
      Getting started with the SDK
    Web3
      Getting started with the API
      Getting started with the SDK

    Authorization

    Implement RBAC with metadata

    3rd Party Integrations

    Planetscale
    Supabase
    Feathery
    Unit

    Testing

    E2E testing
    Sandbox values
Get support on SlackVisit our developer forum

Contact us

Consumer Authentication

/

Guides

/

Authentication

/

Passwords

/

Email verification

/

Overview

Email verification overview

While integrating with Stytch's Passwords product, it's good practice to implement a flow that either allows or requires your users to verify their email addresses during signup.

Why verify users' email addresses?

Email verification isn't strictly required in order to use our Passwords product, but we strongly recommend doing so. There are many reasons why email verification is considered best practice, including:

  • Reducing the number of fraudulent accounts: It's harder for bad actors to create fake accounts if they're required to verify the email address that they use to sign up for your application.
  • Reducing the number of mistyped email addresses: If your users are required to verify their email addresses upon signup, you can be confident that they'll receive any future email communications from you.
  • Preventing an account takeover vector: Stytch automatically deduplicates accounts by email address, but we can only safely do so without requiring a password reset if the user's email address has already been verified. Otherwise, a fraudulent actor could create an account using an email address that they do not own and then gain access to the legitimate owner of that email address's account should the legitimate owner sign up via an email-based authentication method in the future. We also do not allow the addition of a new email address to an existing Stytch User with an unverified email address in order to prevent this same account takeover vector.

In summary, we believe that requiring email verification is the right choice for most applications, and not doing so will limit certain Stytch functionality like automatic account deduplication and the ability to add new email addresses to existing accounts.

How to determine if an email address is verified

To determine whether or not a user's email address has been verified, check the verified value inside the emails array in our Get User endpoint response:

"emails": [
  {
    "email_id": "email-test-81bf03a8-86e1-4d95-bd44-bb3495224953",
    "email": "test@example.com",
    "verified": true
  }
]

How to implement an email verification flow

Stytch email verification logic is flexible, so you can customize your email verification flow to fit the specific needs of your application.

Any authentication flow where the user proves ownership of their email address can be used to verify your Stytch Users' email addresses. This includes our Email Magic Links, Email OTP, and OAuth products (as long as the OAuth provider itself guarantees email verification). Successful completion of our Password reset by email flow will also cause email addresses to be marked as verified.

Check out our Email verification before password creation and Email verification after password creation implementation guides that will introduce you to two different email verification flows and will provide step-by-step implementation instructions for each.

Why verify users' email addresses?

How to determine if an email address is verified

How to implement an email verification flow