Current Auth0 behavior:
When we reset password in Auth0, Auth0 automatically marks the user’s email as verified. But the webhook triggered by Auth0 doesn’t contain the “sv” event for “Success Verification Email” in this case. It contains only “scp” event for “Success Change Password”.
What we implemented:
We wanted to send an email when a user verifies his account. Due to above behavior of Auth0, we also have to send this email on password reset successfully webhook event.
Problem we are facing:
Webhook is triggering whenever a user changes his password, even when the user was already verified before. So our email is getting sent whenever user resets password.
We want to send this email only once when the user is verified.
Expected behavior from Auth0:
-
Don’t set email as verified on “Success Change Password” event
OR
-
Auth0 should also send “Success Verification Email” event (“sv”) in case user email is verified using “Success Change Password” event (“scp”). If user was already verified before resetting his password, then don’t send “sv” event.