v150 · Web APIs · demo

Verification Flow Demo

Chrome 150's Email Verification Protocol provides a browser-mediated flow for verifying email addresses. Walk through each step: email entry, browser request, token delivery, and confirmation — with token anatomy and replay protection explained.

Checking Email Verification Protocol support…
1Enter email
2Browser request
3Token arrives
4Confirmed

Step 1 — Enter your email

In Chrome 150, the browser intercepts this form submission and initiates the Email Verification Protocol handshake before any network request is sent.

Step 2 — Browser sends verification request

The browser constructs a POST request to /.well-known/email-verification on your origin. The request includes the email address and a browser-generated nonce for replay protection.

—

Step 3 — Verification token arrives

The server responds with a signed verification token. The browser validates it and surfaces the verification state.

—

Token anatomy

The token is a signed JWT. Click each segment to inspect:

—

Step 4 — Verified!

✓ Email address — verified
Verification ID: —

Implementation guide

Required server endpoint:

POST /.well-known/email-verification

Receives: { "email": "…", "nonce": "…" }
Returns: { "token": "eyJ…", "expires": "ISO8601" }

The token must be signed with your origin's private key (Ed25519). The public key is published at
GET /.well-known/email-verification-keys

Replay protection

The nonce prevents replay attacks — each verification request gets a unique, single-use value. The server must reject any nonce it has already seen.

NonceUsed atStatus

Fallback — email link flow

If the Email Verification Protocol is unavailable, fall back to the classic "click a link in your email" flow:

// Feature detect const input = document.createElement('input'); input.type = 'email'; if ('onemailverified' in input) { // Chrome 150+ browser-mediated event input.addEventListener('emailverified', event => verifyToken(event.token)); } else { // Classic fallback sendVerificationEmail(email); // sends link to inbox showMessage('Check your email for a verification link.'); }

see also

implementation reference

Need the exact API surface, compatibility boundaries, errors, lifecycle, and source links? Read the matching gendn reference ↗