Verify user_

User verification in Appwrite allows you to verify user email addresses and phone numbers. Users don't need to be verified to log in, but you can restrict resource access to verified users only using permissions.

Verify email

You can verify a user's email with a link or with a code. A link suits web apps, because the user opens it and lands on a verification page in your app. A code suits mobile apps, desktop apps, and any app without a hosted page. The user types the code into your app and doesn't leave it.

Verify with a link

To verify a user's email, first ensure the user is logged in so that the verification email can be sent to the user who created the account. Then, send the verification email specifying a redirect URL. The verification secrets will be appended as query parameters to the redirect URL.

import { Client, Account } from "appwrite";

const client = new Client()
    .setEndpoint('https://cloud.appwrite.io/v1')
    .setProject('<PROJECT_ID>') // Your project ID

const account = new Account(client);

const promise = account.createVerification({
    url: 'https://example.com/verify'
});

promise.then(function (response) {
    console.log(response); // Success
}, function (error) {
    console.log(error); // Failure
});

After the user clicks the link in the email, they will be redirected to your site with the query parameters userId and secret. If you're on a mobile platform, you will need to create the appropriate deep link to handle the verification.

Next, implement the verification page that handles the redirect.

import { Client, Account } from "appwrite";

const client = new Client()
    .setEndpoint('https://cloud.appwrite.io/v1')
    .setProject('<PROJECT_ID>');

const account = new Account(client);

const urlParams = new URLSearchParams(window.location.search);
const secret = urlParams.get('secret');
const userId = urlParams.get('userId');

const promise = account.updateVerification({
    userId,
    secret
});

promise.then(function (response) {
    console.log(response); // Success
}, function (error) {
    console.log(error); // Failure
});

Verify with a code sent through email

To verify a user's email with a code, first make sure the user is logged in. Then call createEmailVerificationOTP, and Appwrite emails the user a 6-digit code that is valid for 15 minutes. Keep the userId from the returned token, because you need it to confirm the code.

import { Client, Account } from "appwrite";

const client = new Client()
    .setEndpoint('https://<REGION>.cloud.appwrite.io/v1')
    .setProject('<PROJECT_ID>');

const account = new Account(client);

const token = await account.createEmailVerificationOTP();

const userId = token.userId;

Next, ask the user for the code from the email. Confirm the email by passing the user ID and the code as the secret.

const response = await account.updateEmailVerificationOTP({
    userId,
    secret: '<CODE>'
});

When the code matches, Appwrite marks the user's email as verified and deletes the code, so it can't be used again. Sending a new code doesn't cancel earlier ones, so any code that hasn't expired still works.

Your app needs to handle these errors in this flow:

• user_email_already_verified: the user's email is already verified, so Appwrite doesn't send a code.
• user_email_not_found: the user has no email address on their account, for example an anonymous user.
• user_invalid_token: the code is wrong, has expired, or was already used.
• general_rate_limit_exceeded: the user made more than 10 requests in an hour. Sending a code and confirming a code count toward the same limit.

Verify phone

To verify a phone number, first ensure the user is logged in and has a phone number set on their account.

const response = await account.updatePhone({
    phone: '+12065550100',
    password: 'password'
});

Then initiate verification by calling createPhoneVerification.

const response = await account.createPhoneVerification();

After the user receives the verification code, complete verification by calling updatePhoneVerification.

const response = await account.updatePhoneVerification({
    userId: '[USER_ID]',
    secret: '[SECRET]'
});

Restrict access

You can restrict resource access to verified users in two ways:

• Use user([USER_ID], "verified") to restrict access to a specific verified user
• Use users("verified") to restrict access to any verified user

Verification events

The following events are triggered during the verification process:

• users.*.verification.* - Triggers on any user's verification token event
• users.*.verification.*.create - Triggers when a verification token for a user is created
• users.*.verification.*.update - Triggers when a verification token for a user is validated

Each event returns a Token Object.