v150 · origin trial · identity

Email Verification Protocol

EVP replaces the email-with-OTP-code dance with a cryptographic proof of ownership. The user's mail provider signs a token vouching that the user controls the address; the site verifies the signature without ever sending a verification email.

Heads up Origin trial. Requires participating mail providers to issue tokens.

concepts

  1. Verification Flow

    Walk through the three-party EVP exchange: site asks for a proof, the browser asks the mail provider, the provider returns a signed token. Each step is shown as a card with the request / response shape.

  2. Token Inspector

    The relying-party angle. Paste an EVP token and decode its JWT — header, claims, signature. Surfaces the issuer / audience / expiry / nonce that your server must verify.

  3. Token Decoder

    Paste any EVP token (or load the built-in sample) to see all three base64url parts decoded side by side. The claims grid highlights the email, exp, nonce, and email_verified fields your server must validate before trusting the proof.

  4. Server Validator

    Paste an EVP JWT and configure your expected audience and nonce to run a full eight-point validation checklist — structure, issuer, audience, expiry, nonce, email presence, email_verified flag. Each check shows pass or fail so you can see exactly what a real server must verify.

  5. Registration Flow

    A five-step EVP registration journey: email entry, browser consent modal, API call, token decode, and server-side validation backed by the demo signing endpoint. Steps through the flow with code snippets and decoded claim views so you can reason about every party's role.

  6. Verification Flow Demo

    Interactive four-step wizard (enter email → browser request → token arrives → confirmed) with HTTP request/response headers at each step. Shows JWT token anatomy with color-coded header/payload/signature panels, a nonce table for replay rejection, and a fallback email-link flow for when the API is unavailable.

why it exists

Verifying ownership of an email address is one of the noisiest interactions on the web. The user copies an OTP from a mail client, deals with phishing risk, and waits for the round-trip — and the site still trusts a six-digit code, not the address itself. EVP replaces that with a cryptographic protocol: the mail provider signs a short-lived token saying "yes, this user controls this address", and the site verifies the signature directly. No OTPs, no email round-trip, no copy-paste from another app.

references

implementation reference

Need the exact API surface, compatibility boundaries, errors, lifecycle, and source links? Read the matching gendn reference ↗