Email verification
Six-digit code to verify your email.
When is it required?
Only for email/password signups. Google Sign-In skips this step (Google has already verified the email).
Getting the code
After "Sign up" we send a 6-digit code to your email. The subject is "Your code: NNNNNN". The code is valid for **15 minutes**. It comes via Resend (from `noreply@raiceptionist.com`) — check spam if it doesn't arrive within a minute.
The screen shows the heading "Verify your email", the email the code was sent to, six separate input boxes (one digit each) and a "Resend" link below.
Wrong code
If you enter a wrong code — you get an error. Up to **5 attempts** per code; after that the code is invalidated and you need a new one. The `/api/auth/verify-email` endpoint also has a rate limit of 10 attempts/min per IP.
After successful verification
After a correct code: we mark the account as `email_verified=true`, clear the hash and expiry, send a welcome email, create a login session, and redirect to /dashboard. All in `/api/auth/verify-email`.