---
title: "The Email Verification API"
description: "The proposed Email Verification API lets a browser verify that a submitted email address belongs to the user without sending them away from the current form to retrieve an OTP or magic link. Its flow involves the user, browser, mailbox provider (issuer), and application server (verifier): after mailbox registration, the browser and issuer create a token that is submitted with the address and checked server-side. Implementation requires an email input, a hidden email-verification-token input with a session-bound random nonce, and token verification using the site origin as audience; a JavaScript package handles parsing, lookups, and signature checks. The proposal is currently limited to Chrome’s origin trial and Gmail mailbox verification, so the source recommends progressive enhancement and other verification APIs where unavailable."
---

# The Email Verification API

[Resend](https://yomu.fyi/company/resend) · Aug 25, 2026

**Type:** Tutorial

## Summary

The proposed Email Verification API lets a browser verify that a submitted email address belongs to the user without sending them away from the current form to retrieve an OTP or magic link. Its flow involves the user, browser, mailbox provider (issuer), and application server (verifier): after mailbox registration, the browser and issuer create a token that is submitted with the address and checked server-side. Implementation requires an email input, a hidden email-verification-token input with a session-bound random nonce, and token verification using the site origin as audience; a JavaScript package handles parsing, lookups, and signature checks. The proposal is currently limited to Chrome’s origin trial and Gmail mailbox verification, so the source recommends progressive enhancement and other verification APIs where unavailable.

## Context

The API is at the proposal stage. Chrome supports the browser API through an origin trial, while mailbox verification is supported only by Gmail; syntax, MX-record, and SMTP verification APIs can be used where this API is unavailable.

## Approach / What changed

Use an email input with type=“email” and autocomplete=“email”, plus a hidden email-verification-token input containing a session-bound random nonce. On submission, send the email address and token to the server, then verify the token against the submitted email, the site origin as audience, and the stored nonce; the email-verification-api npm package performs the involved parsing, DNS and network lookups, and signature verification.

## Takeaways

- The browser and mailbox provider create a token when the entered address is associated with the logged-in mailbox user; the server verifies that token after form submission.
- A hidden email-verification-token field needs a random nonce, and that nonce must be bound to the user session so it can be retrieved during server-side verification.
- The proposal can reduce form friction and invalid-address bounces, but its current Chrome origin-trial and Gmail-only support makes progressive enhancement necessary.

## FAQ

### How does the browser verify ownership without an OTP or magic link?

The mailbox provider registers the user’s mailbox with the browser. When the user enters an associated address, the browser and provider create a token that is submitted with the form and validated by the server.

### Why is a nonce required in the hidden verification field?

The nonce is a random value used only once to ensure each cryptographic session is unique. It is bound to the user session and later supplied during token verification.

### What can applications use when the API is unavailable?

The source suggests progressive enhancement because browser support is limited to Chrome’s origin trial and mailbox verification is limited to Gmail. Other email verification APIs can check syntax, MX records, and SMTP servers.

**Tags:** [API](https://yomu.fyi/topic/api), [Email](https://yomu.fyi/topic/email)

- Source: [Resend](https://resend.com/blog/email-verification-api)
- Source URL: https://resend.com/blog/email-verification-api
- Ingested by Yomu: 2026-09-19T09:54:39.431Z

[Read original post](https://resend.com/blog/email-verification-api)