⚠️ You must have your own environment as an enterprise customer to have access to this feature.
Introduction
Email verification confirms that every account on your platform is linked to a real, accessible email address before the user can continue. Cogniss supports enforcing email verification per account across your whole environment, so you can require it for every user across all of your apps.
Enforcing email verification is a recommended security practice, and for many organisations a compliance requirement. Turning it on brings immediate benefits:
Reduces access risk: guarantees each active account belongs to a real, authorised email address, preventing fraudulent sign-ups, registration typos, and account hijacking.
Secures password resets: self-service password recovery relies on a verified email channel, so a verified address stops "ghost accounts" from being exploited during resets.
Keeps user data accurate (UK GDPR): validating emails at the point of entry helps keep your user database clean and up to date, in line with data-protection requirements to hold accurate personal data.
Aligns with NHS DSPT: for partners operating within or alongside NHS frameworks, validating identity at the user layer supports the access-control and identification standards in the annual Data Security and Protection Toolkit.
How to enable email verification for your environment
This section is for app admins managing a Cogniss environment.
Go to Admin > Account in your Cogniss environment.
Turn on Email Validation in the Account Requirement section (enforce for all users).
Save your changes.
Once enabled, email verification applies to every user across all apps in your environment. New and existing users will be asked to verify their email the next time they sign in (see below).
What this means for your users
Verification is a quick, one-step process: the user receives a verification link by email and clicks it to confirm their address. After that, they continue using the app as normal.
New users: When a new user registers after email verification is enabled, they're prompted to verify their email address before they can continue. They receive a verification link in their inbox, click it, and they're set up and good to go.
Existing users: The next time an existing user signs in after the change, they're prompted to verify their email before continuing. They receive the same verification link, click it once, and then carry on using the app as usual. They only need to do this once.
How to configure your email verification content
You can customize the verification email your users receive so it matches your app's name and tone.
In Admin > Email, find the Validate email section.
Edit the wording for email title and body text: you can reference your environment and include any instructions your users need.
Save. New verification emails will use your updated content.
⚠️ Important : The Validate your email element requires a code to be placed as a link. This code automatically generates the functional Validate link when the email is sent. To implement this, simply copy {{{validateLink}}} and use it as a hyperlink for Validate your email text, check the screenshot below for instructions.
Email Sample:
Use this email sample and customize it for your platform, if you want to create a custom validation email. Make sure to include the {{{validateLink}}} within the “Validate your email” text.
Hi {{user.username}}, Please validate your email address to complete your account setup and continue using the platform. Validate your email ←🔴Insert {{{validateLink}}} as hyperlink If you did not create this account, you can safely ignore this email. Thank you. |
Frequently Asked Questions
Do users who already verified their email need to do it again?
No. Users whose email addresses were already verified are unaffected and won't be prompted again. Only users with an unverified email will be asked to verify at their next sign-in.
Can a user keep using the app without verifying their email?
No. Once email verification is enforced for your environment, users must verify their email before they can continue. It's a one-time, one-click step, after which they use the app normally.
What happens if a user doesn't receive the verification email?
Ask them to check their spam or junk folder first, and confirm the email address on the account is spelled correctly. They can request the verification link again from the prompt.
Does enabling this affect all of my apps?
Yes. Email verification is set at the environment level, so once enabled it applies to every app in that environment automatically. You don't need to configure it for each app.
Is email verification related to OTP sign-in and password resets?
Yes. A verified email is what makes one-time passcode (OTP) sign-in and secure self-service password resets possible, because both rely on a trusted email channel. Existing users who haven't verified their email yet won't be able to receive a one-time passcode. They'll need to sign in with their password the first time to verify their email, and can use OTP from then on.