Email verification

Learn the steps to implement Laravel’s email verification feature. Covers model preparation, three route definitions, the verified middleware, customization, and events.

Introduction

Email verification is a mechanism for confirming that a user actually owns the email address they registered with. Laravel provides sending and verifying confirmation emails out of the box, so you can build a secure authentication flow with minimal implementation.

If you use a starter kit, the authentication screens and email verification flow are already built in. If you implement it manually, follow the steps on this page to define the models, routes, and views yourself.

Preparing the model and database

Implement MustVerifyEmail

Make sure App\Models\User implements Illuminate\Contracts\Auth\MustVerifyEmail.

<?php

namespace App\Models;

use Illuminate\Contracts\Auth\MustVerifyEmail;
use Illuminate\Foundation\Auth\User as Authenticatable;
use Illuminate\Notifications\Notifiable;

class User extends Authenticatable implements MustVerifyEmail
{
    use Notifiable;
}

Once you add this interface, a confirmation email is automatically sent to newly registered users. If you implement registration without a starter kit, fire the Registered event after successful registration.

use Illuminate\Auth\Events\Registered;

event(new Registered($user));

Verify the email_verified_at column

You need an email_verified_at column on the users table. It is typically included in the default 0001_01_01_000000_create_users_table.php migration.

Routing (three routes)

Email verification defines three routes: verification.notice, verification.verify, and verification.send.

1. Define the verification notice route (verification.notice)

   Returns a screen telling unverified users to “please check your email.”

   Route::get('/email/verify', function () {
       return view('auth.verify-email');
   })->middleware('auth')->name('verification.notice');
   
2. Define the verification handler route (verification.verify)

   When the user clicks the link in the email, this validates the signed URL and completes verification.

   use Illuminate\Foundation\Auth\EmailVerificationRequest;
   
   Route::get('/email/verify/{id}/{hash}', function (EmailVerificationRequest $request) {
       $request->fulfill();
   
       return redirect('/home');
   })->middleware(['auth', 'signed'])->name('verification.verify');
   
3. Define the resend route (verification.send)

   Resends the confirmation email if the user loses it.

   use Illuminate\Http\Request;
   
   Route::post('/email/verification-notification', function (Request $request) {
       $request->user()->sendEmailVerificationNotification();
   
       return back()->with('message', 'Verification link sent!');
   })->middleware(['auth', 'throttle:6,1'])->name('verification.send');
   

Protecting routes

To grant access only to verified users, use the verified middleware. It is typically combined with auth.

Route::get('/profile', function () {
    // Only verified users may access
})->middleware(['auth', 'verified']);

When an unverified user visits the route, Laravel automatically redirects them to verification.notice.

Customization

To customize the verification email body, set VerifyEmail::toMailUsing in the boot method of your AppServiceProvider.

use Illuminate\Auth\Notifications\VerifyEmail;
use Illuminate\Notifications\Messages\MailMessage;

public function boot(): void
{
    VerifyEmail::toMailUsing(function (object $notifiable, string $url) {
        return (new MailMessage)
            ->subject('Verify Email Address')
            ->line('Click the button below to verify your email address.')
            ->action('Verify Email Address', $url);
    });
}

Events

The Illuminate\Auth\Events\Verified event is fired when email verification occurs. Starter kits handle this automatically, but for manual implementations, add event handling as needed.