# How to deal with unverified users

**URL:** <https://community.auth0.com/t/how-to-deal-with-unverified-users/91808>\
**Category:** Get Help\
**Tags:** verification\
**Created:** [October 5, 2022, 6:32am UTC](https://community.auth0.com/t/how-to-deal-with-unverified-users/91808 "2022-10-05T06:32:14Z")\
**Posts on this page:** 8\
**Page:** 1

<div class="post-metadata">

**Author:** ![raph90](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/raph90/32/36888_2.png) [@raph90](https://community.auth0.com/u/raph90)\
**Post date:** [October 5, 2022, 6:32am UTC](https://community.auth0.com/t/how-to-deal-with-unverified-users/91808/1 "2022-10-05T06:32:14Z")

</div>

Hi everyone,

I’m using a basic username - password flow, but I’m worried about spam bots clogging up my MAU count.

What would be the best way to deal with unverified users? Perhaps a cron job script that calls the API every week and deletes users that aren’t verified and who haven’t tried to login within x amount of time?

It would be great to hear feedback on this. Thanks!

---

<div class="post-metadata">

**Author:** ![rueben.tiow](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/rueben.tiow/32/11646_2.png) [@rueben.tiow](https://community.auth0.com/u/rueben.tiow)\
**Post date:** [October 6, 2022, 6:37pm UTC](https://community.auth0.com/t/how-to-deal-with-unverified-users/91808/3 "2022-10-06T18:37:09Z")

</div>

Hi @raph90,

Thanks for reaching out to the Auth0 Community!

The best way to deal with unverified users is to set up a [Post-Login Action](https://auth0.com/docs/customize/actions/flows-and-triggers/login-flow#access-control) that checks if the user has verified their email.

If so, they can continue onto the application as usual. Otherwise, this will prevent them from consuming your Monthly Active Users (MAU) count.

Below is the Post-Login Action script needed to accomplish this:

```auto
exports.onExecutePostLogin = async (event, api) => {
  if (!event.user.email_verified) {
    api.access.deny(`Please verify your email address to continue onto ${event.client.name}.`);
  }
};

```

Please let me know if there’s anything else I can do to help.

Thanks,  
Rueben

---

<div class="post-metadata">

**Author:** ![raph90](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/raph90/32/36888_2.png) [@raph90](https://community.auth0.com/u/raph90)\
**Post date:** [October 9, 2022, 11:57am UTC](https://community.auth0.com/t/how-to-deal-with-unverified-users/91808/4 "2022-10-09T11:57:52Z")

</div>

Hi Rueben, thank you for your reply.

If I call api.redirect.sendUserTo instead of api.access.deny in that callback, will I still not be consuming my MAU count?

As it is, that callback is sending me back to my application with the error embedded in the URl.

Thanks,

Raph

---

<div class="post-metadata">

**Author:** ![fhn](https://upload.wikimedia.org/wikipedia/commons/thumb/7/7c/User_font_awesome.svg/768px-User_font_awesome.svg.png) [@fhn](https://community.auth0.com/u/fhn)\
**Post date:** [October 11, 2022, 8:38pm UTC](https://community.auth0.com/t/how-to-deal-with-unverified-users/91808/5 "2022-10-11T20:38:26Z")

</div>

Calling “api.redirect.sendUserTo” instead of “api.access.deny” in that callback, will it account in MAU count?  
Exactly same question to [How to deal with unverified users - #4 by raph90](https://community.auth0.com/t/how-to-deal-with-unverified-users/91808/4)

---

<div class="post-metadata">

**Author:** ![rueben.tiow](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/rueben.tiow/32/11646_2.png) [@rueben.tiow](https://community.auth0.com/u/rueben.tiow)\
**Post date:** [October 12, 2022, 3:20pm UTC](https://community.auth0.com/t/how-to-deal-with-unverified-users/91808/6 "2022-10-12T15:20:02Z")

</div>

Hi @raph90 and @fhn,

Thank you for both of your responses.

To answer both of your questions, using the `api.redirect.sendUserTo` will consume your MAU count, whereas the `api.access.deny` will not consume your MAU count.

This is because the redirect call requires a `/continue` endpoint to be called to resume authentication, thus increasing your MAU count.

> **[Redirect with Actions](https://auth0.com/docs/customize/actions/flows-and-triggers/login-flow/redirect-with-actions#resume-the-authentication-flow)**
>
> Learn how to use post-login Actions to redirect users before an authentication transaction is complete.

I hope this helps!

Please reach out if you have any additional questions.

Thanks,  
Rueben

---

<div class="post-metadata">

**Author:** ![fhn](https://upload.wikimedia.org/wikipedia/commons/thumb/7/7c/User_font_awesome.svg/768px-User_font_awesome.svg.png) [@fhn](https://community.auth0.com/u/fhn)\
**Post date:** [October 13, 2022, 9:20pm UTC](https://community.auth0.com/t/how-to-deal-with-unverified-users/91808/7 "2022-10-13T21:20:26Z")

</div>

Thanks for conforming.  
Now question is how to redirect user to a page using “api.access.deny” .

My requirement is not use MAU and also redirect to a page showing blocker message in good UI etc.

---

<div class="post-metadata">

**Author:** ![rueben.tiow](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/rueben.tiow/32/11646_2.png) [@rueben.tiow](https://community.auth0.com/u/rueben.tiow)\
**Post date:** [October 14, 2022, 5:27pm UTC](https://community.auth0.com/t/how-to-deal-with-unverified-users/91808/8 "2022-10-14T17:27:50Z")

</div>

Hi @fhn,

Thank you for your response.

> [@fhn](#):
>
> Now question is how to redirect user to a page using “api.access.deny” .

When redirect users after denying them access, you will have to use a combination of both the `api.access.deny()` and `api.redirect.sendUserTo()` methods.

Allow me to clarify, the first step is to deny the user access by calling the `api.access.deny()` method, and then you can proceed with calling the `api.redirect.sendUserTo()` method to redirect them to your preferred page.

Please let me know if you have any additional questions.

Thanks,  
Rueben

---

<div class="post-metadata">

**Author:** ![system](https://global.discourse-cdn.com/auth0/original/3X/b/5/b560f266932fcce5d57f09a6595bd50518cae3f3.jpeg) [@system](https://community.auth0.com/u/system)\
**Post date:** [October 28, 2022, 5:28pm UTC](https://community.auth0.com/t/how-to-deal-with-unverified-users/91808/9 "2022-10-28T17:28:10Z")

</div>

This topic was automatically closed 14 days after the last reply. New replies are no longer allowed.