Chrome Trials Email Verification API to Eliminate Email-Based Verification Steps

Chrome Origin Trial Commences

Google has initiated an origin trial for the Email Verification API within Chrome 150 on desktop. This API, proposed by the WICG, enables browsers to confirm a user's email address ownership without requiring a verification email to be sent. Gmail is the initial email provider participating in this trial.

Redefining Email Verification

The new API replaces traditional one-time codes or magic links. The current process often involves users navigating away from a website to their email inbox, retrieving a code, and then returning to the site, which can lead to user drop-off. The API introduces a three-party model where the browser acts as an intermediary between the website (verifier) and the email provider (issuer). If a user is already logged into their email provider, the browser can silently fetch a signed token and input it into the form, which the server then validates. The email provider does not learn which website requested the verification.

Developer Implementation and Community Reception

For developers, the front-end implementation requires adding an autocomplete hint to the email field and a hidden input for a session-bound nonce. Server-side work involves validating the token's signature against the provider's keys. Phil Nash of Resend has published an npm package and a Next.js example to assist with this validation. Community feedback on Hacker News highlighted the frustration of context switching during sign-ups and the issues with verification emails being blocked or filtered as spam, suggesting the API could be a significant improvement.

Privacy and Complexity Concerns

Some commenters raised concerns about the API's privacy claims and perceived complexity. One argument stated that the privacy enhancement is minimal because websites typically send follow-up emails after verification anyway, negating the issuer's blindness to the requesting site. Another commenter suggested the new process adds unnecessary complexity without solving fundamental issues, potentially benefiting larger entities over smaller ones, and described the issuer's blindness as a "functional liability."