Checkout stays locked until you confirm

Pay, Direct, and credit stay blocked until the email code lands.

Resend uses the same unknown-email copy

Unknown addresses get the same generic copy. Kumir does not 404.

Link lasts 48 hours

The emailed link expires after two days. Ask again if it timed out.

Signup lands here

After create, web signs in and opens this page. Native waits for the deep link.

Redirects stay on Kumir

redirectFromSearch only allows same-origin paths. Default return is home.

Not Forgot password

Resetting a password is /forgot. This page only confirms a new account.

Not Log in

Already confirmed? /login. This page does not check a password.

Not password reset

Entering a reset code is /reset. This page does not change the password.

No invented Resend key

EMAIL_PROVIDER=resend only when RESEND_API_KEY is set. Otherwise Kumir logs.

/verify is reserved, not a username

Signup lands here. That path is reserved, like /login and /forgot.

The form never fakes a confirm flag

Confirm only runs after a valid hashed code. A bad code does not mint the confirm flag.

Native uses the same verify API

iOS VerifyEmailFlow and Android splash call POST /api/v1/auth/verify. Same generic resend.