Login blocked by email verification: verification enforcement and resend flows

Email verification blocks

The behavior

User signs up, tries to log in, gets "Please verify your email before logging in" or an Action denies them. The account exists; the email is unverified.

Why it happens

• The tenant requires verified emails (an Action/Rule enforcing event.user.email_verified, or the connection setting).
• The verification email went to spam, or the built-in Auth0 email provider delivered slowly, or the link expired (links expire after a configurable period).

Fix

1. Provide a "resend verification email" button in your app calling the Management API POST /api/v2/jobs/verification-email with the user_id. Do not make users re-sign-up.
2. Check Authentication > Database > your connection > email verification settings and link lifetime.
3. For production, configure a custom email provider (SendGrid/SES/etc). Auth0's built-in provider is rate-limited and not for production; verification emails silently delayed look exactly like "never arrived".
4. If the product should allow login before verification, change the enforcement Action to warn instead of deny, but gate sensitive actions on email_verified.

Debugging

• Tenant logs: look for the verification email job events and the failed login with the verification description.
• Dashboard > User Management > user detail shows email_verified true/false directly.

Checklist

• Resend flow exists before users ask.
• Custom email provider configured for production.

Auth0's Management API documents the verification-email job endpoint. Email verification enforcement patterns are documented in the Actions and database connection docs. Verified against live docs 2026-09-26.