Best Practice to Verify User Identity Before Email Update in Auth0

vlad.murarasu
Thu, 29 Jan 2026 12:48:45 +0000

Hi again @nihalm5930,

To answer your specific questions regarding the “Cleanup” phase:

Is it supported and safe to delete the original (old) primary identity entirely?

It is safe, but typically you don’t delete the “user record”; you unlink the secondary identity and then update the primary identity’s email.

1. Verify: The user clicks the link in the verification email for the secondary identity.

2. Update Primary: Use the Management API (PATCH /users/{id}) to update the primary user’s email to the new email address and set email_verified: true.

3. Unlink/Delete Secondary: Use the Unlink a User Identity API to remove the secondary identity. This prevents the “new” email from being associated with a separate, dangling account.

Are there any Auth0 constraints or best practices around removing the original identity after promotion (for example, impacts on user_id, logs, sessions, or refresh tokens)?

User ID Stability: Always try to keep the original user_id. If you delete the primary record and try to use the secondary record as the new primary, the user_id changes. This will invalidate existing Refresh Tokens and can break integrations.

Session State: Updating the email on the primary profile does not automatically kill the user’s current session, but the next time a token is issued (via a Refresh Token or new login), it will contain the updated email claim.

Is there a recommended sequence for promotion and cleanup to avoid locking the user out (for example, promote → reauthenticate → delete old identity)?

To ensure the user is never stuck in “limbo”, follow this logic:

1. Promote: Update the Primary identity’s email to the new, verified email.

2. Unlink: Remove the secondary identity record.

3. Silent Re-auth: In your application, if you need the ID Token to reflect the new email immediately, perform a “Silent Authentication” (prompt=none) to get a fresh token without a full redirect.

Have a good one,
Vlad