Store email sign-in state
Persist a pending email magic-link sign-in in an adapter database.
Auth.js · Type Alias
VerificationToken
VerificationToken is the database record for email magic-link authentication. It contains the user’s email identifier, a hashed token, and its expiration time.
How it works
VerificationToken describes the database record used for email sign-in. It stores the email identifier, a hashed token, and the absolute expiration time; Auth.js checks these values when the magic link is used and removes the record after successful use.
Syntax
type VerificationToken = {
identifier: string
token: string
expires: Date
}Parameters
| Name | Type | Description |
|---|---|---|
identifier | string | Email address associated with the verification attempt. |
token | string | Hashed verification value. |
expires | Date | Absolute time at which the token expires. |
Key points
- The type models temporary credentials for email-based sign-in.
- Auth.js creates the record when an Email provider flow starts.
- expires stores the absolute expiration time as a Date.
- identifier stores the email address associated with the sign-in attempt.
- token stores the hashed value used to validate the email link.
- One user may have several active records, for example from separate devices.
Common mistakes
- The token field is hashed with the AuthConfig secret, so implementations should not treat it as the original email-link token.
- An expired token cannot complete sign-in; the user must restart the email authentication flow.
Example: Define a verification token
type VerificationToken = {
identifier: string
token: string
expires: Date
}
const verificationToken: VerificationToken = {
identifier: "user@example.com",
token: "hashed-token",
expires: new Date(Date.now() + 86_400_000),
}Creates a value matching the documented verification-token shape.
When to use it
Check token validity
Validate a link before creating an authenticated session.
Track concurrent attempts
Allow independent sign-in attempts from multiple devices.
Interview questions
QWhat does VerificationToken represent?
VerificationToken represents a temporary email-authentication record. Its fields are identifier, token, and expires; the identifier is the user’s email address, while token is hashed and expires is an absolute date.
Follow-up: Why should the token be removed after successful verification? Because deletion enforces single-use behavior and prevents replay of the same magic link.
QHow is VerificationToken used during email sign-in?
Auth.js creates the record when an Email provider sign-in begins. When the link is followed, the submitted email and token are checked against the stored values and expiration before the user is signed in.
Follow-up: What happens when the values do not match or the token has expired? The sign-in does not complete, so the user must begin the sign-in process again.
QWhat fields and lifecycle characteristics does it have?
The record contains an email identifier, a hashed token, and an expiration date. Multiple open records may exist for one user, such as when sign-in is attempted from different devices.
Follow-up: Why might applications periodically clean these records? Abandoned or failed flows can leave unnecessary rows in the database.
Related
createVerificationTokenuseVerificationTokenEmail providerAuthConfig.secretVerification tokens