Resend verification email
Auth
Resend verification email
Request a fresh 6-digit verification code. 60-second cooldown.
POST
Resend verification email
Overview
Generates a fresh verification OTP and dispatches it via Resend. Used when the original code expired (5-min TTL) or after 5 failed attempts on/verify-email.
Anti-spam cooldown. A new code cannot be requested within 60 s of the previous one. Inside that window the call returns 429 RATE_LIMITED with a Retry-After header and a retryAfterSec field in the Problem Details body.
Privacy. The endpoint always returns 200 OK when the email is unknown or already verified — the response cannot be used to enumerate accounts or trigger silent emails on guess.
Authentication
None required.Path parameters
None.Query parameters
None.Request body
| Field | Type | Required | Allowed values | Example |
|---|---|---|---|---|
email | string | yes | RFC 5322 valid, lowercased server-side | alice@example.com |
Example payload
Response — 200 OK
| Field | Type | Notes | Example |
|---|---|---|---|
ok | boolean | Always true. The actual side effect (email sent or not) is intentionally not exposed. | true |
Example response
Error responses
| Status | Code | Meaning |
|---|---|---|
| 400 | VALIDATION_FAILED | Email malformed. |
| 429 | RATE_LIMITED | Inside the 60 s cooldown window. Wait retryAfterSec seconds (also in Retry-After header). |
Example error — 429
Retry-After: 47 HTTP header is also set. Clients should prefer the header for parsing; the body field exists for JSON-only consumers.
Side effects
- Inserts a new
otp_codesrow (purpose: 'email_verify', 5-min TTL). Any prior outstanding code for this email is invalidated. - Sends an email via Resend with the 6-digit code.
- Both side effects are skipped when the email is unknown or already verified.
See also
- Verify email — confirm the code.
- Register (email + password).