Hi @akshay3
Thank you for reaching out to us!
I understand the flow that you are trying to achieve and you are definitely on the right track - in order to complete your desired flow, my recommendation would be to:
- use our Forms feature within a Post-Login Action in order to check if the user’s email has been verified and deny access based if it has not;
- in the Action you can then render a Form that displays your message to the user and they will not move forward with logging in until they verify their email.
It is also possible to not use Forms and simply display the error message within the Post-Login Action itself, although Forms could prove more useful in customizing the look of the error message.
You can use the following template to add to a Post-Login Action in order to deny access if email is not verified:
exports.onExecutePostLogin = async (event, api) => {
if (!event.user.email_verified) {
api.access.deny('Please verify your email before logging in.');
}
};
You can also use event.client within the Action in order to have it trigger according to which application the user is trying to access, more information can be found in our documentation on Actions Triggers: post-login - Event Object - Auth0 Docs.
Allow me to share some additional resources that can prove useful with your integration:
- Render Forms using Actions;
- Custom Messages and Translation;
- UN-verified email - resend Verification Email via Action - #4 by dawid.matuszczyk.
Hope this helped, please do not hesitate to reach out to us for any other issues or requests.
Have a great one!
Gerald