---
title: "Verify a code sent to an email address"
method: POST
path: "/email_addresses/{email_address_id}/attempt_verification"
tags: ["Email Addresses"]
---

# Verify a code sent to an email address

`POST /email_addresses/{email_address_id}/attempt_verification`

Checks a one-time code against the verification identified by
verification_id, and returns the verification with its updated status
(`verified`, `unverified`, `expired`, or `failed`) and attempt count, so a
backend driving its own frontend can react on every attempt — an incorrect
or expired code is reported through the status, not as an error. Resubmitting
a verification whose code was already accepted is rejected with a
`verification_already_verified` error. If the code
is correct and the email address is not already verified, it is also marked
as verified as a side effect (just as it would be in a frontend verification
flow); an already verified email address is left unchanged. It never creates
a session; to sign the user in afterwards, mint a sign-in token.

## Path parameters

- `email_address_id` string, required

## Request body

- object
  - `verification_id` string, required — The ID of the verification to check, such as one returned by prepare_verification
  - `code` string, required — The verification code that was sent to the email address

## Response `200`

The verification. After prepare_verification it is pending (unverified);
after attempt_verification its status reflects the attempt outcome.

- object
  - `object` string — The type of the verification object.
  - `id` string — The ID of the verification. Pass this to attempt_verification.
  - `status` string — The status of the verification (unverified, verified, expired, or failed).
  - `strategy` string — The verification strategy (email_code or phone_code).
  - `attempts` integer, nullable — The number of attempts made against this verification.
  - `expire_at` integer, nullable — Unix timestamp (milliseconds) at which the code expires.
  - `channel` string, nullable — The channel the code was sent over (phone numbers only).

## Other responses

- `400` — Request was not successful
- `401` — Authentication invalid
- `403` — Authorization invalid
- `404` — Resource not found
- `500` — Request was not successful

---

[API](https://skmtc.net/clerk/apis/clerk-backend-api.md) · [All operations](https://skmtc.net/clerk/apis/clerk-backend-api/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/clerk/clerk-backend-api/revisions/cf036e7951d3/schema)