Email address verification
Mailing a one-time link or code to a new signup and only trusting the address once they click it back.
See it
What it is
Email verification proves the person signing up can actually open the inbox they typed. You mail a one-time token (a link, or a 6-digit code they paste back), and only when it comes back do you flip 'email_verified' to true on the account. The token should be random, single-use, hashed in your database, and expire in something like 15 minutes to 24 hours.
Reach for it whenever the email address is load-bearing: password resets, billing receipts, team invites, or anything where a typo means a stranger receives someone's data.
Do not confuse it with double opt-in, even though the mechanics look identical. Double opt-in is a marketing step that records consent to receive a mailing list, and it is what keeps your sending reputation clean. Verifying a product account records that someone controls the inbox, and nothing more. A verified account email is not permission to market to it, so if you want both, ask for both and store them as two separate facts with their own timestamps.
Two gotchas. First, decide what an unverified account can actually do, because a hard wall at signup tanks activation while a soft nudge lets people explore. Second, corporate link scanners and email security products click every URL in an inbox, so a GET request that instantly consumes the token can burn it before the human ever sees the message. Land on a confirmation page and require a click, or use a code instead of a link.
Ask AI for it
Add email verification to signup. On registration, create the user with email_verified false, generate a cryptographically random token, store only its hash with a 24 hour expiry, and email a link to /verify?token=... The verify route must show a confirmation page with a button (do not consume the token on the GET, since inbox link scanners prefetch URLs), then mark the address verified and delete the token on the POST. Handle expired and already-used tokens with a friendly 'resend verification email' path, rate limit resends per address, and let unverified users browse but block invites and billing.