Email verification

The E-Mail Verification feature ensures that user email addresses are valid and secure before completing account creation, adding a layer of protection against fraudulent accounts and supporting legal compliance.

Integration Process

SCAYLE's E-Mail Verification can be integrated via the ready-to-use UI component to suit various implementation needs.

Option	Description
Webcomponent	Plug-and-play UI component provided by Scayle that handles the entire verification process with no additional integration effort required.
SDK / API (non-component)	Drive the verification flow directly through the Authentication SDK and build your own user interface. SCAYLE provides the SDK methods, events, and backend flow; your storefront is responsible for the UI.

How it works

Verification Types

SCAYLE's E-Mail Verification can happen in two methods.

Type	Description
`verification_code`	A 6-digit numeric code that the customer enters manually in the interface.
`magic_link`	A link included in the same email. It directs the customer to a dedicated verification page and carries the verification code as a URL parameter, so the customer can skip entering the code manually.

Only one active code per user is allowed at a time.

User Flow

If a user registers with an unverified email, the system sends a 6-digit code and magic link for manual verification, which upon successful validation updates the email as verified, allowing seamless login or checkout continuation.

If a user logs in with is_email_verified = false, the system does not automatically send a verification email. If the user did not receive the original email or the link expired, a new verification code can be triggered manually.

When Verification is Skipped

The Email verification is generally skipped for accounts created or authenticated via a trusted Identity Provider (IDP) such as Facebook or Apple. IDPs typically are handling the primary email confirmation, streamlining the user experience.

SDK / API Flow

If you prefer to build your own verification interface, you can drive the entire flow through the Authentication SDK, available at window.scayle.auth.V3. In this model, SCAYLE provides the SDK methods, events, and backend verification flow, while your storefront renders the interface and reacts to the verification states.

Responsibilities

Area	Owner
User interface (code entry, resend, magic-link landing page)	Your storefront
Verification methods, events, and backend flow	SCAYLE

SDK Methods

sendEmailVerification triggers the verification email containing the 6-digit code and the magic link.

confirmEmailVerificationUrl is optional and defines the page the magic link
points to. If omitted, it defaults to the current page URL, with the customer's
email and customerId appended as query parameters.

confirmEmailVerification confirms the code entered by the customer.

Events

Event	Emitted when	Payload
email:verification:required	After login or registration, when the customer's email is unverified.	{ customerId, source, email }
email:verification:requested	A call to `sendEmailVerification` succeeds.	{ challengeCode, validUntil }
email:verification:confirmed	Verification completes successfully.	{ accessToken }
email:verification:error	A verification request or confirmation fails.	{ error }

Flow

Listen for email:verification:required to detect when a customer needs to verify their email address.
Call sendEmailVerification to send the verification email, and retain the returned challengeCode.
Render your own interface for the customer to enter the 6-digit code, or handle the magic-link landing at your confirmEmailVerificationUrl.
Call confirmEmailVerification with the challengeCode and the customer's verificationCode.
On email:verification:confirmed, store the returned accessToken. Handle email:verification:error to surface failures to the customer.

For the full method and event reference, see the Authentication API.

Verification Steps

User Registers
The customer starts registration or checkout as a guest. The system creates a customer record with is_email_verified = false.
Verification Triggered
The backend will generate and send a 6-digit verification_code and the magic_link to the customer's email address.
User Confirms
The user either enters the code manually in the UI or clicks the magic link received via email to verify their email address.
System Validates
The system validates the code or link, applies attempt and expiration limits, logs relevant events, and updates the customer record with is_email_verified = true.
Login or Continuation
Once verification is successful, the customer can proceed to login or continue the checkout process without additional email confirmation steps.

Verification on Email Change

When a registered user updates their email address in their account settings, the system immediately marks the new address as unverified. The full verification process is then re-triggered to the new email address to maintain security and data integrity.

Configuration Options

Email verification behavior is fully configurable in the SCAYLE Panel, including expiry time, attempt limits, and code generation caps. This can be configured under General ➜ Configuration ➜ Email Verification Configuration.

Option	Default	Description
`enabled`	false	Globally enable/disable verification
`code_expiration (minutes)`	10 minutes	Time before code expires
`max_code_attempts`	3	Max code entry attempts per code…
`code_attempt_timeframe (minutes)`	60 minutes	…within this timeframe
`max_verification_attempts`	3	How many times a user can enter a wrong code before needing a new one

If the max_verification_attempts is reached, the system temporarily blocks further code creations and require the customer to wait for code_attempt_timeframe (minutes) , e.g. 60 min before retrying.

Email Templates

Configure the following email templates in the SCAYLE Panel: SCAYLE ➜ Email Templates

Verification E-Mail → customer-email-verification-mail\

Legal & Compliance

All verification data is meticulously tracked to provide a clear audit trail. This information is available on request through the SCAYLE Account Manager for further review and compliance purposes.

Field	Description
`verification_timestamp`	Time when code or link was confirmed
`confirmation_email_times`	Timestamps of all sent verification emails
`successful_attempt_timestamps`	Logged only for `verification_code`
`verified_via`	Tracks if magic link or code was used

Data Retention & Anonymisation

To comply with data privacy regulations, unverified customer accounts (those where the email was never confirmed) are automatically anonymised after a 2 year period. This ensures personal data is not retained indefinitely for unconfirmed users.