J
jeremy
5 minutes
Verifying a New Account's Email Address with a Token
Email verification uses the same shape as a reset — random token, hash stored, short expiry, one use — but its job is to confirm the address belongs to the person signing up before the account counts as real. It stops typos, disposable-address signups and someone claiming an address they do not own. Decide up front what an unverified account may do, because a flag nobody checks protects nothing.