Email Verification for Sign Ups: Add It With Claude Code

Someone signs up to your SaaS with a typo in their email address, or with an address that belongs to someone else. Without a check, your project has no way of knowing. Email verification for sign ups solves this: your project sends a short email with a link or code, and the account is confirmed when the person uses it.

This guide is for people building SaaS products and sites with Claude Code who want new accounts confirmed before they're fully active. You'll see how the flow works, the message to send Claude Code, a sample email you can adapt, and how to treat people who haven't verified yet.

Why verify new users' email addresses?

Verifying an email address proves the person signing up can open emails sent to it. That matters because so much of your SaaS depends on email reaching the right person.

• Password resets go to the right inbox. A password reset email gives access to whoever controls the address, so you want to know it's really theirs.
• Typos get caught on day one, not weeks later when a receipt or invoice goes nowhere.
• Other people's addresses stay protected. Without verification, anyone can sign up using an address they don't own.

OWASP, the nonprofit that publishes widely used web security guidance, recommends confirming that someone owns an address before their account is fully switched on.

How does an email verification flow work?

Your project creates the account, sends a one-time link or code, and marks the account as verified once the person uses it.

Link or code? A link is one click. A code is typed into your site. Auth0, a sign-in service, points out that automatic email scanners can follow links and verify an account by accident, which a typed code avoids. For most SaaS products a link works well; choose a code if you'd rather each person confirms by hand.

Two security basics. OWASP recommends that tokens are random, work once and expire. It also suggests your sign-up form shouldn't reveal whether an address is already registered. Show the same message either way, such as "We've emailed a link to the address you gave."

Already using a sign-in tool? Check what it sends

If Claude Code built your sign-ups on a sign-in service such as Supabase Auth or Auth0, verification may already be switched on. On hosted Supabase projects, users must confirm their email to sign in by default, and Auth0 sends verification links at sign-up by default.

The catch is sending. Supabase's built-in email service is meant for trying things out: it sends only to members of your project's team and is limited to 2 emails an hour. For real users, Supabase asks you to send through your own email service, either through its custom SMTP settings or its Send Email Hook. (SMTP is the standard way email servers pass messages to each other.)

We use Supabase for sign-ins. Check whether email confirmation is turned on, and set it up so Supabase's confirmation emails go out through SimpleSends so every new user gets them.

Claude Code checks your settings, connects the two and sends you a test.

What to tell Claude Code to add email verification

First, connect an email service. With SimpleSends, that takes four steps:

1. Sign up on the SimpleSends website and follow the steps there to set up the email address you'll send from. To send from your own domain, this includes adding a few DNS records where your domain is registered. (DNS records are settings that tell the internet your email service may send for your domain; our guide to verifying a domain for email walks through them.)
2. In Claude Code, open Customize, then Connectors, choose Add, then Add custom connector. Fill in the fields below. A connector is how Claude Code talks to an outside service, using a standard called MCP (Model Context Protocol).
3. When Claude prompts you to connect, log in to SimpleSends.
4. Back in the Claude Code chat, tell Claude Code: "I've connected SimpleSends for all transactional email." It takes it from there, including adding what your project needs to send email.

Then describe what you want, the way you'd brief a developer on your team:

I'd like new users to confirm their email address when they sign up. Send them a short verification email from hello@yourcompany.com with one button. The link should work once and expire after 24 hours. Until they verify, let them sign in but show a banner asking them to check their inbox, with buttons to resend the email or change their address. Keep inviting teammates and paid upgrades locked until they've verified. If someone signs up with an address that's already registered, show the same message as a normal sign-up. Show me a preview of the email and send me a test before it goes live.

What to expect: Claude Code looks at how your sign-ups work now, writes and designs the email, builds the page the link opens and the banner, and shows you a preview. It then sends a test to your own inbox from the chat. Once you're happy, real verification emails go out from your live project whenever someone signs up.

To check it end to end, sign up with your own address, click the link, then try the same link again (it should be refused). Our guide to testing your emails before users see them has a fuller checklist.

Sample email

Keep the verification email short and focused on one action. Supabase's own guidance for sign-in emails suggests few links, no promotional content and no names or other details the person typed in.

SubjectConfirm your email address

Hi there,

Thanks for signing up to Yourcompany. Please confirm this is your email address so we can keep your account secure.

Confirm my email

This link works once and expires in 24 hours. If it has expired, sign in and choose "Resend email".

If you didn't create an account, you can ignore this email and nothing will happen.

The Yourcompany team

Save the friendly introduction to your product for the welcome email you send once they've verified.

How should you handle unverified users?

You have two main choices: block unverified people from signing in, or let them in with limited access. Either way, give them a clear way to finish verifying.

Whichever you pick, build these in:

• A resend button, limited to one email every minute or so, so nobody can flood an inbox.
• A way to fix a typo: let people change their address and send a fresh email.
• A clean-up rule for accounts that never verify, for example removing them after 30 days.

For people who haven't verified yet, add a "Resend verification email" button limited to one every minute, and let them correct their email address if they typed it wrong. If a link has expired, explain that and offer a new one. Remove accounts that are still unverified after 30 days. Send the welcome email once they've verified, not at sign-up.

If someone says their email never arrived, ask Claude Code. With SimpleSends connected, it can read your send logs and delivery status and tell you whether the email went out. Our guide to checking whether your emails actually sent covers the usual causes.

Verification is one of several emails most SaaS products need. See the full list in 12 transactional emails every SaaS needs, and if you're considering passwordless sign-in, read about magic link login.