Ask HN: Would you see value in a “verify email” API?
In the app, the user enters their email address and payment information. Before processing their payment, I would like to verify that the user actually owns the email address that they entered.
Of course the popular way of doing this is to send the user an email with a link that they have to click. To continue the trend of not maintaining my own backend, it would be nice to have an API that does this for me.
The basic functionality would be as follows. For simplicity, I'll refer to this hypothetical thing as "the API."
1. App sends an email address to the API. 2. The API sends an email to the email address. 3. User clicks a link in the email, taking them to a simple "thank you"-style page at the API. 4. The API marks that email as verified. 5. App makes another call to the API and sees that the email is verified. Done.
Same could apply for SMS, I suppose. There seems to be a wealth of email verification services that focus on bulk validation of MX records and things like that. But I don't see anything like this.
Would this be valuable? Too niche? Already exists and I can't find it?
Would love your thoughts. Thanks!
So Let's say your app pings the API with the email and a special loooooooong human readable string of a random words:
"A horse is an grass, it feeds on animal!"
Note the phrase (key) should not make sense or be correct grammatically, it could be just a bunch of words jumbled together.
The API sends this to the user, the user enters the same on your page with grammatically correct one.
"A horse is an animal, it feeds on grass!"
Boom, you have a very high entropy, a secure paraphrase that's probably reliably secure and can be enhanced to timeout against brute force attacks. It's really up to you to what you want to do with the API and your app.
Looks complex, but should be a good starting point to build something. Goodluck!
Is that what you meant?
EDIT: ok, you don't want any backend so webhooks won't work.
This is valuable, but I want to be able to know for sure that 1. the email is "real" and 2. the person using the email address actually has access to it and can receive emails on it. Thus the process of actually sending an email to the provided address and making them click a link.
I've still not seen anything that provides this functionality.
Yes, I see what you mean. Maybe I should give it a shot. :)
As for the technical part, I think you're better off passing a callback URL to the service so it posts to it when the user verifies the email. The callback URL could be an AWS lambda.
Agreed that the Callback URL is definitely preferable, if the consuming application has a backend (Lambda or more substantial). Thanks!
On 3 I could see the api just redirecting back to the app. And 4 is retained for future backup?
Just to share how this is made smoother somewhere else in the world: App displays QR code on screen either on webpage or in-store POS, user scans QR code, payment is made and funds transfered instantly.
I was thinking either pinging or some sort of a "check" button that the user would click/tap (e.g. Cloudflare's button to check the status of NS transfers). Not the smoothest part of the idea. This decision would ultimately be left to the consumer of the API. Also, in thinking this through a little more I think it is also applicable to applications that do have their own backend, in which case they could provide a callback.
I like your idea on 3/4. That could maybe be a configurable option
This way I can update a user record and make a nicer experience the next time the user comes back rather than having to make a call to the API to check they are verified.