[SOLVED] verification email

[merry creek]

How do i send a verification email to a new user when they sign up without creating a session. I'm trying to use ssr. And I keep getting different answers wherever I look.
I've tried account.createVerification(). I've tried users.createVerification(). I've tried adminAccount.createVerification(newUser.$id, verificationUrl). This is crazy. Why isn't there any solid information on this?
I'm constantly getting errors:
Account created, but failed to send verification email: [e-mail] (role: applications) missing scope (account).
The appwrite ai will tell me one thing and then something completely different. Now it told me appwrite will send it automatically by ensuring that the user's emailVerification status is set to false upon creation. And that I can set it up and configure the verification url in Auth in the Appwrite Console. Is that even true?
Why is this so complex in Appwrite?

[wary jetty]

You would have to create a session to call verification

[celest thicket]

Yes, but I also think you can just create an Appwrite function and send the verification email via the server sdk (whichever you use). But normally it is standard that you create a user session and whenever he comes to your app you check if his mail is verified or not. If not, you redirect him to a screen stating that his mail has to be verified.

[merry creek]

Thank you. That's all I needed. I couldn't find a straight answer. I kept finding different things.

[fiery ether]

[SOLVED] verification email

[fiery ether]

Did you read this? https://appwrite.io/docs/products/auth/verify-user#verify-email

[merry creek]

yes i've read that multiple times. I've asked the appwrite ai. And I kept getting errors.

[fiery ether]

And it said:

To verify a user's email, first ensure the user is logged in. Then send a verification email with a redirect URL.

So what was confusing about that?

[merry creek]

The confusion isn't about how account.createVerification(url) works when a user is logged in.

The problem is I'm trying to implement a specific signup flow:

1. User signs up
2. Account is created on the backend (SSR, server action, admin client – whatever you want to call it)
3. I don't want to automatically log the user in at this point. They shouldn't have an active session before their email is verified
4. I then need to trigger the verification email from the server/admin context for this newly created, non-logged-in user

The docs say, 'ensure the user is logged in' before calling account.createVerification(url). That's exactly the scenario I'm trying to avoid. I want to send the verification email without creating that initial session.
So, the question is: What's the Appwrite-recommended way for a server-side admin client to trigger the standard URL-based email verification for a specific userId immediately after creating them, without first establishing a session for that user?

I've tried:

• adminAccount.createVerification(userId, url) -> scope error, seems it still expects a user context even if I pass a userId
• adminUsersService.createVerification(userId) -> method doesn't exist
• adminAccount.createEmailToken(userId, email) -> sends an OTP email
• Relying on automatic sending after adminUsersService.create() -> no email was sent in my tests, even with SMTP confirmed working (as createEmailToken did send an email)

If the only way to send that verification URL is via a client-side account.createVerification(url) which requires a prior session, then the flow has to be: create user -> create session -> then client sends email. That's fine if it's the only way, but it means the user is logged in before verification, which wasn't my initial goal for a stricter flow.

Is there an admin SDK method I'm missing that directly triggers the URL-based verification email for a given userId? Or is the 'create session first' route the only way?

[merry creek]

So you respond with a snarky comment, assuming I can't comprehend a couple of sentences, and when I respond, I get no response?

[wary jetty]

Creating account is a way as also appwrite has to check either to call for verification or not.
But there is another method
Using api(maybe)
This exist but i dont know where it is in the doc.
There is a method to just set the verification true in server sdk without any secret key or anything.
Just implement your own method to actually verify then use that function to just verify the user.
I forgot where it is but if you can find it hope it helps.
I will continue to search it also
And i dont think there is any other way

[wary jetty]

The flaw (I think) in this case without a session is
You would have to create a session to get the userId later.
Say you created an account
Then just didnot verify.
So you left the app.
Then few days later
Came to verify
Now you have no way to get the userId except creating a session.
I dont know if i missed something but creating a session is the way to get the UserId

[fiery ether]

Thanks for the insight. I guess we need to explicitly explain that they need to be logged in so that the backend knows who to send the verification email to.

There is nothing wrong with letting the user have a session and there's no reason to try and avoid it.

There are alternatives but they're hacky and not worth it. For example, you can forcefully create a session and then call the create verification using that session. Or you can fully manage the verification yourself and then call users.updateEmailVerification()