Signup verification
Signups without an invitation can be asked to prove an email address they already have at another provider, or a mobile number, before the mailbox is made. It keeps out most automated signups, together with the captcha and the network checks in Abuse protection. Signups with an invitation link or code skip it.
Turning it on
In the Zappocity panel, Settings → Abuse protection, the Signup verification card (or corpsuite signup-verification set):
| Setting | What it does |
|---|---|
| Ask signups to verify | No, An email address elsewhere, A mobile number or Either (the person chooses) |
| Accounts one number may verify in 30 days | Stops one phone from making many accounts (2 by default) |
| Twilio account SID, auth token, send texts from | Your Twilio account, and the number (+14155550100) or messaging service (MG...) texts come from. The token is stored sealed and never shown again. |
| Only to these calling codes | Such as +1 and +44. Texts to some countries cost much more; empty sends anywhere Twilio does. |
Email codes come from the platform's notice address (Settings → Notice mail), so set one first. Use Send a test to check texts and email arrive before turning verification on.
corpsuite signup-verification set mode=either twilioAccountSid=AC... twilioAuthToken=- twilioFrom=+14155550100 smsPrefixes:='["+1"]'
corpsuite signup-verification test method=sms to=+14155550100What the person sees
The signup page gets a step Confirm you are a person: they enter an email address or mobile number, choose Send code, and type the 6-digit code they get. The code works for 15 minutes and for 5 tries. Then Create my account makes the mailbox.
- An email address on a domain hosted here is refused: it has to be one they already have elsewhere.
- At most 5 codes an hour are sent from one network, and 3 to one address or number.
- If the signup fails (the name is taken, say), the code still works for the next try.
Afterwards
The new mailbox shows as verified, by email or sms, under Verification on its page (see Account security). A verified email address becomes the mailbox's recovery address, so password reset links can go there.
For apps and scripts: POST /api/signup/code sends a code, and POST /api/signup takes verification: {id, code} (see api/signup.yaml).