Best Practice to Verify User Identity Before Email Update in Auth0

vlad.murarasu
Tue, 27 Jan 2026 14:09:19 +0000

Hi again @nihalm5930,

Yes, by default, updating the email attribute via the Management API is a destructive action that overwrites the existing value immediately. To achieve your goal—where the change only becomes “effective” once the new email is proven—use Account Linking. This allows you to treat the new email as a secondary identity until it is verified, at which point you can promote it to the primary identity.

To ensure the original email remains valid until the new one is confirmed, follow this workflow:

1. Create a “Shadow” User

When the user wants to change their email, do not update their current profile. Instead, create a new user in your database (connection) with the new email address.

API: POST /api/v2/users

Payload: Set email_verified: false and verify_email: true.

2. Link the Accounts

Link the newly created “shadow” identity to the existing, logged-in user profile.

API: POST /api/v2/users/{primary_id}/identities

The old email remains the Primary identity, and the new email becomes a Secondary identity.

3. Verification & Promotion (Auth0 Actions)

Use an Auth0 Post-Login Action to check if the secondary identity has been verified. If it has, you can then “swap” them or promote the new email to the primary spot.

exports.onExecutePostLogin = async (event, api) => {
  const secondaryEmail = event.user.identities.find(id => id.isSocial === false && id.user_id !== event.user.user_id);

  if (secondaryEmail && secondaryEmail.profileData && secondaryEmail.profileData.email_verified) {
    // Logic to promote the secondary email to primary
    // This usually involves a backend call to your API to swap the identities
  }
};

4. Implementation Logic for Rollback

Because the original email remains the primary identity throughout this process, the user can still log in with their old email if they lose access to the new one. If they decide to cancel the change, you will delete the secondary identity.

Have a good one,
Vlad