Email Confirmation

Verify user email addresses through confirmation tokens sent via email. Email confirmation may be required before accessing certain features or logging in.

Confirm Email

Verify a user's email address using a confirmation token sent during registration.

Endpoint: POST /api/auth/confirm-email

Authentication: Not required (public endpoint)

Body Parameters

Parameter	Type	Required	Description
`token`	string	Yes	Email confirmation token from verification email

Request

curl -X POST https://api.storno.ro/api/auth/confirm-email \
  -H "Content-Type: application/json" \
  -d '{
    "token": "abc123xyz789def456ghi..."
  }'

// Extract token from URL
const urlParams = new URLSearchParams(window.location.search);
const token = urlParams.get('token');

const response = await fetch('https://api.storno.ro/api/auth/confirm-email', {
  method: 'POST',
  headers: {
    'Content-Type': 'application/json',
  },
  body: JSON.stringify({
    token: token,
  }),
});

if (response.ok) {
  window.location.href = '/login?confirmed=true';
}

$client = new \GuzzleHttp\Client();

$response = $client->post('https://api.storno.ro/api/auth/confirm-email', [
    'json' => [
        'token' => $_GET['token'],
    ],
]);

if ($response->getStatusCode() === 200) {
    header('Location: /login?confirmed=true');
    exit;
}

Response

Success Response (200 OK)

{
  "message": "Email confirmed successfully. You can now log in to your account."
}

Error Codes

Code	Description
`400`	Bad Request - Missing or invalid token format
`401`	Unauthorized - Token is invalid, expired, or already used
`409`	Conflict - Email is already confirmed

Error Response Examples

Invalid or Expired Token (401)

{
  "code": 401,
  "message": "Email confirmation token is invalid or has expired."
}

Email Already Confirmed (409)

{
  "code": 409,
  "message": "This email address has already been confirmed."
}

Token Already Used (401)

{
  "code": 401,
  "message": "This confirmation token has already been used."
}

Resend Confirmation Email

Request a new confirmation email if the original was not received or has expired.

Endpoint: POST /api/auth/resend-confirmation

Authentication: Not required (public endpoint)

Body Parameters

Parameter	Type	Required	Description
`email`	string	Yes	Email address of the account

Request

curl -X POST https://api.storno.ro/api/auth/resend-confirmation \
  -H "Content-Type: application/json" \
  -d '{
    "email": "[email protected]"
  }'

const response = await fetch('https://api.storno.ro/api/auth/resend-confirmation', {
  method: 'POST',
  headers: {
    'Content-Type': 'application/json',
  },
  body: JSON.stringify({
    email: '[email protected]',
  }),
});

if (response.ok) {
  console.log('Confirmation email sent (if account exists and is unconfirmed)');
}

Response

Success Response (200 OK)

For security reasons, the endpoint always returns success regardless of whether the email exists or is already confirmed.

{
  "message": "If an unconfirmed account with that email exists, a new confirmation email has been sent."
}

Error Codes

Code	Description
`400`	Bad Request - Invalid email format
`429`	Too Many Requests - Rate limit exceeded

Error Response Examples

Invalid Email Format (400)

{
  "code": 400,
  "message": "Validation failed",
  "errors": {
    "email": ["This value is not a valid email address."]
  }
}

Rate Limit Exceeded (429)

{
  "code": 429,
  "message": "Too many confirmation email requests. Please try again in 5 minutes."
}

Confirmation Email

When a user registers or requests a resend, they receive an email containing:

A welcome message
A confirmation link with embedded token
Instructions on what to do if they didn't register
Link expiration time (24 hours)

Example Confirmation Email:

Subject: Confirm Your Storno.ro Email Address

Hi John,

Welcome to Storno.ro! Please confirm your email address by clicking the link below:

https://storno.ro/confirm-email?token=abc123xyz789def456ghi...

This link will expire in 24 hours.

If you didn't create an account with Storno.ro, you can safely ignore this email.

Thanks,
The Storno.ro Team

Token Expiration

Confirmation tokens have specific lifecycle:

Validity: 24 hours from issuance
Single-use: Token is invalidated after successful confirmation
Renewable: User can request new token via resend endpoint
Automatic cleanup: Expired tokens are periodically removed

Rate Limiting

To prevent abuse, confirmation email requests are rate-limited:

Per Email: Maximum 3 requests per hour per email address
Per IP: Maximum 10 requests per hour per IP address
Cooldown: 5 minutes between requests for the same email

Complete User Flow

Registration with Email Confirmation

User Registers

await fetch('/api/auth/register', {
  method: 'POST',
  headers: { 'Content-Type': 'application/json' },
  body: JSON.stringify({
    email: '[email protected]',
    password: 'SecurePass123!',
    firstName: 'John',
    lastName: 'Doe',
  }),
});

System Sends Confirmation Email
- User receives email with confirmation link
- Link contains unique token
User Clicks Confirmation Link
- Browser opens: https://storno.ro/confirm-email?token=abc123xyz...
- Frontend extracts token and calls API

Frontend Confirms Email

const token = new URLSearchParams(window.location.search).get('token');

await fetch('/api/auth/confirm-email', {
  method: 'POST',
  headers: { 'Content-Type': 'application/json' },
  body: JSON.stringify({ token }),
});

User Can Now Login
- Redirect to login page with success message
- User authenticates with confirmed account

Implementation Examples