Request an email verification token

Request a single-use email verification token for an identity. Your app then sends the token to the identity, e.g. as a link in an email: JSONPad never sends email itself. See password reset and email verification for the whole flow.

The API token needs the verify-email permission for the identity's group. A token can be requested for each identity once a minute, and requesting a new token replaces the previous one. Tokens expire after the identity group's token lifetime.

A token is only issued for an identity that has an email address which isn't verified yet. The token only verifies the address it was issued for.

Unless the identity group delivers tokens to a webhook, this returns the token. Anyone who can call it with your API token could take over any identity in the group, so only call it from a server, with an API token that never leaves it. Requests from a browser (with an Origin header) are refused.

POST https://api.jsonpad.io/identities/email-verification

Example

1234567

curl https://api.jsonpad.io/identities/email-verification \
  -H "Content-Type: application/json" \
  -H "x-api-token: <YOUR TOKEN>" \
  -d '{
        "group": "sample-group",
        "name": "Sample Identity"
      }'

Parameters

No parameters

Request headers

required
x-api-tokenstringYour API token.

Request body

{group: "sample-group"
email: "identity@example.com"
}

optional
groupstringThe identity group. Leave this out for identities with no group.
optional
identityIdstringThe identity's id. Exactly one of identityId, name and email is required.
optional
namestringThe identity's name.
optional
emailstringThe identity's email address (ignoring case).

Response body

200 OK

The token and the identity it's for, so your server knows where to send it. If no activated, unlocked identity matches, everything is null. If the identity has no email address, or it's already verified, verificationToken and expiresAt are null.

{verificationToken: "mprJNQxDHeU1eUgCZaoAsnUtf6Z9Q6EZu80RpsW_cHM"
expiresAt: "2026-09-18T20:32:10.596Z"
identity: {id: "3d2e151c-5aa7-4e0c-96e6-136ec5308fd0"
createdAt: "2026-09-18T20:32:10.596Z"
updatedAt: "2026-09-18T20:32:10.596Z"
name: "Sample Identity"
displayName: "Sample Display Name"
email: "identity@example.com"
emailVerified: false
hasPassword: true
tags: [0: "my-app"
]
group: "sample-group"
lastLoginAt: "2026-09-18T20:32:10.596Z"
activated: true
}
}

Don't tell the person using your app whether an identity was found: always show the same message, such as "if there's an account for that address, we've sent an email".

202 Accepted

If the identity group delivers tokens to a webhook, the token is sent there instead, and the response is always the same, whether or not an identity was found.

{delivery: "webhook"
}

Response headers

No response headers

2026-09-17