Best Practice to Verify User Identity Before Email Update in Auth0

nihalm5930
Thu, 29 Jan 2026 06:07:09 +0000

Hi Vlad,

Thank you for the detailed explanation - this is very helpful and aligns well with what we’re trying to achieve.

I have one clarification and a few follow-up questions around the final state of the account once the new email has been verified and promoted.

Once the secondary (new) email identity has been verified and promoted to become the primary identity:

1. Is it supported and safe to delete the original (old) primary identity entirely?

2. Are there any Auth0 constraints or best practices around removing the original identity after promotion (for example, impacts on user_id, logs, sessions, or refresh tokens)?

3. Is there a recommended sequence for promotion and cleanup to avoid locking the user out (for example, promote → reauthenticate → delete old identity)?

Our intent is that after successful verification and promotion, the old email should no longer be usable for login, password resets, or recovery, while ensuring the account remains stable and auditable.

Thanks again for your guidance — this approach looks solid, and we just want to be sure we handle the final transition correctly.

Best regards,
Team myworth.ai