NYYU Logo
APIRegistration

Verify Account

Activate user accounts with email verification code sent during registration

✉️ EMAIL VERIFICATION

Verify Account

Confirm email ownership and activate user accounts with secure 6-digit verification codes.

Registration Step 2

This is the second step after signup. Users must verify their email before proceeding to 2FA setup.

Overview

The verifyAccount mutation validates the 6-digit code sent to the user's email during registration. Successful verification activates the account and allows the user to proceed with 2FA setup.


GraphQL Schema

mutation {
  verifyAccount(
    email: String!
    code: String!
  ): String!
}

Parameters

email

Required

String

Email address being verified. Must match the signup email.

code

Required

String

6-digit verification code from email. Valid for 10 minutes.


Return Values

Success

Email successfully verified. Account activated. Proceed to 2FA setup.

Failed

Incorrect or expired code (codes expire after 10 minutes). Request new code.

⚠️Cannot find user

Email not registered. Exception thrown with message: "Cannot find user by {email}"


Example Usage

Request

mutation VerifyEmail {
  verifyAccount(
    email: "demouser@nyyu.io"
    code: "794221"
  )
}

Successful Response

{
  "data": {
    "verifyAccount": "Success"
  }
}

Account Verified

Email demouser@nyyu.io successfully verified. Proceed to set up two-factor authentication.

Failed Verification

{
  "data": {
    "verifyAccount": "Failed"
  }
}

Verification Failed

Invalid or expired code. Please request a new verification code.


Implementation Example

Verification Flow Integration

// Example: Email verification handler
async function handleVerifyEmail(email, code) {
  try {
    const result = await graphqlClient.mutate({
      mutation: gql`
        mutation VerifyAccount($email: String!, $code: String!) {
          verifyAccount(email: $email, code: $code)
        }
      `,
      variables: {
        email: email,
        code: code
      }
    });

    if (result.data.verifyAccount === "Success") {
      // Email verified successfully
      showSuccess("Email verified! Setting up 2FA...");
      
      // Clear pending email from storage
      sessionStorage.removeItem('pendingEmail');
      
      // Redirect to 2FA setup page
      router.push('/setup-2fa');
    } else {
      // Verification failed
      showError("Invalid or expired code. Please try again.");
      
      // Optionally show resend button
      showResendOption(email);
    }
  } catch (error) {
    if (error.message.includes("Cannot find user")) {
      showError("Email not found. Please sign up first.");
      router.push('/signup');
    } else {
      showError("Verification failed. Please try again.");
    }
  }
}

// Auto-resend after expiration (10 minutes)
function setupExpiryTimer() {
  const expiryTime = 10 * 60 * 1000; // 10 minutes
  setTimeout(() => {
    showWarning("Code expired. Click to request a new one.");
    enableResendButton();
  }, expiryTime);
}

Use Cases

📧

Email Ownership

Confirm user has access to the email address provided during registration

🔐

Account Activation

Activate newly registered accounts before allowing 2FA setup and platform access

🛡️

Security Validation

Prevent fraudulent signups and ensure legitimate email addresses

⏱️

Time-Limited Codes

10-minute expiry ensures codes cannot be used after extended periods


Best Practices

⏰ Code Expiry Warning

Display countdown timer showing remaining time before code expires (10 minutes)

🔄 Easy Resend

Provide prominent "Resend Code" button for expired or un-received codes

📧 Email Pre-fill

Auto-populate email field from signup step to reduce user input errors

🎯 Input Validation

Validate code format (6 digits) client-side before API call to reduce errors

📱 Mobile Optimization

Use numeric keyboard on mobile devices and consider auto-fill from SMS