# Passwordless email update & verification best practices **URL:** \ **Category:** Get Help\ **Tags:** email-verification, passwordless, verification-email\ **Created:** [February 26, 2019, 3:17pm UTC](https://community.auth0.com/t/passwordless-email-update-verification-best-practices/21803 "2019-02-26T15:17:00Z")\ **Posts on this page:** 6\ **Page:** 1
**Author:** ![danillouz](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/danillouz/32/13905_2.png) [@danillouz](https://community.auth0.com/u/danillouz)\ **Post date:** [February 26, 2019, 3:17pm UTC](https://community.auth0.com/t/passwordless-email-update-verification-best-practices/21803/1 "2019-02-26T15:17:00Z")
Hi, While struggling with [updating- and verifying a paswordless user’s email address](http://community.auth0.com/t/change-passwordless-user-email/21681), I was wondering what the best practices are around this topic. I couldn’t find any documented best practices for passwordless email update + verification. I was hoping that I could just update the `email` , set `email_verified` to `false` and `verify_email` to `true` using the management API . And that Auth0 would send a verification email, which would “automagically” update the user’s `email_verified` property to `true`, after the user clicked the email verification link. But I’m also wondering: - Should I manually update the `email_verified` property with a custom API endpoint and verification link? - Should a user even be able to update their email using passwordless? Or should something like account linking be applied with a different email? - What’s the best way to prevent a user using passwordless from “locking themselves out”? If they update the email with one they don’t have access to (either by mistake or on purpose). And then log out without being able to verify the new email or receive any email for that matter. Any advice would be greatly appreciated! ---
**Author:** ![konrad.sopala](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/konrad.sopala/32/13516_2.png) [@konrad.sopala](https://community.auth0.com/u/konrad.sopala)\ **Post date:** [August 26, 2019, 7:34am UTC](https://community.auth0.com/t/passwordless-email-update-verification-best-practices/21803/2 "2019-08-26T07:34:06Z")
Hey there! Sorry for such a delayed response! We’re doing our best in providing you with the best developer support experience out there but sometimes our bandwidth is just not enough for all the questions coming in. Sorry for the inconvenience! Can you let us know if you still require further assistance from us? ---
**Author:** ![danillouz](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/danillouz/32/13905_2.png) [@danillouz](https://community.auth0.com/u/danillouz)\ **Post date:** [August 27, 2019, 1:46pm UTC](https://community.auth0.com/t/passwordless-email-update-verification-best-practices/21803/3 "2019-08-27T13:46:40Z")
Hi Konrad, that’s okay, I imagine you’re all quite busy. I stopped using passwordless and switched to email + password strategy, because I couldn’t figure this out. But I think it would be quite useful if you could answer my questions (please also see the linked issue) in case other community members find this while struggling with the same problem. And to be honest, I’m still curious how one would Implement this properly. Additionally, (at the time) I couldn’t find a solution in the documentation either. If it’s still not documented, it might also be a good idea to include it in the docs one way or another. ---
**Author:** ![konrad.sopala](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/konrad.sopala/32/13516_2.png) [@konrad.sopala](https://community.auth0.com/u/konrad.sopala)\ **Post date:** [August 27, 2019, 1:53pm UTC](https://community.auth0.com/t/passwordless-email-update-verification-best-practices/21803/4 "2019-08-27T13:53:07Z")
Sure! I’ll dig into that! ---
**Author:** ![konrad.sopala](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/konrad.sopala/32/13516_2.png) [@konrad.sopala](https://community.auth0.com/u/konrad.sopala)\ **Post date:** [March 23, 2020, 10:39am UTC](https://community.auth0.com/t/passwordless-email-update-verification-best-practices/21803/6 "2020-03-23T10:39:35Z")
Hey there! Sorry for the delay in response once again but it must have got trapped in between the question coming into community + I just got some guidance from our engineering teams. We advise to use PATCH /api/v2/users/:id { email: ‘new\_email’, email\_verified: false, verify\_email: true }? More info: [Auth0 Management API v2](https://auth0.com/docs/api/management/v2#!/Users/patch_users_by_id) ---
**Author:** ![konrad.sopala](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/konrad.sopala/32/13516_2.png) [@konrad.sopala](https://community.auth0.com/u/konrad.sopala)\ **Post date:** [March 23, 2020, 10:39am UTC](https://community.auth0.com/t/passwordless-email-update-verification-best-practices/21803/7 "2020-03-23T10:39:38Z")