Email Verification

Prime requires new users to verify their email address before they can access the app. This is also used for magic link sign-in.

How it works

1. User signs up → a verification token is generated and stored in the database
2. A verification email is sent via Mailgun with a link containing the token
3. User clicks the link → the token is validated and the account is marked as verified

Configuration

In demo-server/.env:

# How long a verification token is valid (default: 24 hours)
EMAIL_VERIFY_TOKEN_TTL_HOURS=24

# Max verification emails a user can request per day (prevents abuse)
EMAIL_VERIFY_MAX_RETRIES_PER_DAY=5

# Rolling window for the retry limit (hours)
EMAIL_VERIFY_RETRY_WINDOW_HOURS=24

Magic link configuration

Magic links are a passwordless sign-in method. The user enters their email, receives a one-time link, and clicking it signs them in directly.

# How long a magic link is valid (default: 5 minutes)
MAGIC_LINK_EXPIRY_MINUTES=5

Keep this short (5–10 minutes) for security. The link is single-use — it's invalidated immediately after the first click.

Resend behavior

If a user requests another verification email before the first one expires:

• The old token is invalidated
• A new token is issued and emailed
• The retry counter increments

Once EMAIL_VERIFY_MAX_RETRIES_PER_DAY is reached, the user must wait until the EMAIL_VERIFY_RETRY_WINDOW_HOURS window resets.

API endpoints

Method	Endpoint	Description
POST	/auth/verify-email	Verify a token from the email link
POST	/auth/resend-verification	Resend the verification email
POST	/auth/magic	Request a magic link
POST	/auth/magic/verify	Verify a magic link token