Email verification

The right person. The right inbox. Verified in seconds.

Try the flow. No email is sent.

Verify an email address

VERIFICATION FLOW

1 Email address

2 Enter code

3 Verified

One-time codes. Time-limited access. A safer connection.

Verification settings

Code lengthA little extra security

Code expirationKeep your codes fresh

Auto-verifyVerify when the code is complete

Demo inbox

LOCAL PREVIEW

Small code. Strong protection.

Thoughtfully simple, by design.

Unique, every single time

A fresh, randomly generated code
for every verification request.

Here for a limited time

Codes expire automatically.
Less time, less room for risk.

One code. One use.

Once verified, your code retires.
Exactly how it should be.

Connect Codepost to your signup flow. Your server sends the email, then verifies the code the visitor enters. Keep API keys on your server.

YOUR CONNECTION

Server API keys

Checking your account…

Copy your key now

The full key is shown only once. Save it as CODEPOST_API_KEY in your server’s secret settings.

Up to 5 active keys. Revoking a key stops future API calls using that key. All keys share your account’s subscription and email allowance.

QUICK START

Verify an email during signup

Create a key and save it on your server.
Call POST /api/v1/send when a visitor asks to verify their email.
Store the returned challengeId and email in that visitor’s server-side session.
Call POST /api/v1/verify with the entered code. Mark that email verified only after a successful response.

Base URL:

Node.js server example. Requires an environment variable named CODEPOST_API_KEY.

Request and response

Send: {email, length: 6, seconds: 300}
Returns {challengeId, expiresAt, resendAt, length}. Times are Unix milliseconds. The code is sent only by email.

Verify: {challengeId, code: "123456"}
Returns {verified: true, email}. Send the code as a string to preserve leading zeroes.

Choose 4, 6 or 8 digits and 120, 300 or 600 seconds. Defaults: 6 digits and 300 seconds. Each challenge allows 5 attempts and one successful use. A new send invalidates earlier codes for that email in your account.

Limits: 60 API requests per minute per account, a 30-second resend cooldown per recipient, and 1,000 emails per UTC calendar month shared with the dashboard. Live sending requires an active paid subscription.

Errors: 400 invalid input, wrong/expired/used code; 401 invalid key; 402 subscription required; 403 browser request blocked; 429 rate or allowance limit; 502 provider error; 503 service setup incomplete.

Add rate limits and abuse protection to your own public signup endpoints. Never embed this key in browser JavaScript. Match the returned email to the pending email in your server session; email verification proves inbox access, not the person’s identity.