Email verification

​

In Studio

​

The flow

1. signUp returns verificationRequired: true and no session.
2. Show “Check your inbox” with a resend button.
3. The person clicks the link and lands on your redirectTo page.
4. That page confirms the token and the person is signed in.

// 1–2. After sign-up
await pawabase.auth.resendVerification({ email, redirectTo: "https://myapp.com/verified" });

// 4. On the landing page
const token = new URL(location.href).searchParams.get("token")!;
const session = await pawabase.auth.verifyEmail(token);

pb.auth.resend_verification(email=email, redirect_to="https://myapp.com/verified")

session = pb.auth.verify_email(token)

​

Other ways an address becomes verified

• Using an email code or sign-in link proves the inbox.
• A social provider may report the address as verified.
• An administrator creates the user with emailVerified: true (the default for admin-created accounts).
• Company sign-in connections have Trust the email address to treat the provider’s email as verified.

​

Show verification status

function VerifyBanner() {
  const { user } = useAuth();
  if (!user || user.email_verified) return null;
  return (
    <p>
      Please confirm your email.{" "}
      <button onClick={() => pawabase.auth.resendVerification({ email: user.email })}>Resend</button>
    </p>
  );
}

​

Changing the email later

await pawabase.auth.updateUser({ email: "new@example.com" });

// On the page the link opens
await pawabase.auth.confirmEmailChange(token);

pb.auth.update_user(email="new@example.com")
pb.auth.confirm_email_change(token)

​

Make landing pages robust

• Links are single-use and expire. If verifyEmail throws, show “This link has expired” with a button to send a new one.
• Don’t show or log the token.
• After success, send the person where they were going.

try {
  await pawabase.auth.verifyEmail(token);
  navigate("/");
} catch {
  setMessage("This link has expired. We can send you a new one.");
}