Emails
Many screens are reached from an email link rather than from another screen. Hover an email name for a preview of the email; hover a route for the screen it lands on. Subscription Platform emails are out of scope, except two that land on an accounts screen.
Templates: libs/accounts/email-renderer/src/templates/. Links are built by libs/accounts/email-renderer/src/renderer/email-link-builder.ts.
Map
Emails by landing screen
| Landing route | Emails | Sent when |
|---|---|---|
/verify_email | verify, verifyPrimary, verificationReminderFirst, verificationReminderSecond, verificationReminderFinal | Link-based account or primary-email confirmation, and reminders at 1, 5, and 15 days. Current sign-up uses codes. |
/complete_signin | verifyLogin | Confirm a sign-in from a new device by link. |
/report_signin | unblockCode | Customs blocked a sign-in; the code unblocks, the link reports. |
/complete_reset_password | recovery | Link-based password reset. Current reset uses a code. |
/reset_password | passwordChanged, passwordReset, postChangeRecoveryPhone, postRemoveRecoveryPhone | Password or recovery phone changed; "wasn't you?" link. |
/settings/change_password | passwordChangeRequired | Suspicious activity; password change is mandatory. |
/settings/two_step_authentication/replace_codes | lowRecoveryCodes | Few backup codes left. |
/settings | newDeviceLogin | Sign-in from a new device. |
/settings | postAddTwoStepAuthentication, postChangeTwoStepAuthentication, postRemoveTwoStepAuthentication, postNewRecoveryCodes, postConsumeRecoveryCode | Two-step authentication and backup code changes. |
/settings | postAddRecoveryPhone, postSigninRecoveryPhone, postSigninRecoveryCode | Recovery phone added or used; backup code used. |
/settings | postAddAccountRecovery, postChangeAccountRecovery, postRemoveAccountRecovery, passwordResetAccountRecovery, passwordResetWithRecoveryKeyPrompt, passwordResetRecoveryPhone | Account recovery key created, changed, removed, or used. |
/settings | postAddPasskey, postRemovePasskey, postAddLinkedAccount | Passkey registered or removed; Google or Apple account linked. |
/settings | postChangePrimary, postVerifySecondary, postRemoveSecondary | Primary or secondary email changes. |
/settings | inactiveAccountFirstWarning, inactiveAccountSecondWarning, inactiveAccountFinalWarning | Account scheduled for deletion due to inactivity. |
/connect_another_device | postVerify, cadReminderFirst, cadReminderSecond | Welcome after confirmation; nudges to set up a second device. |
/post_verify/finish_account_setup/set_password | subscriptionAccountReminderFirst, subscriptionAccountReminderSecond | Account created by a subscription purchase has no password yet. |
| none, code typed on the current screen | verifyShortCode, verifyLoginCode, passwordForgotOtp, verifySecondaryCode, verifyAccountChange, passwordlessSigninOtp, passwordlessSignupOtp | One-time codes. |
| none | adminResetAccounts | Admin-initiated bulk password reset notice. |
Query parameters on email links
/verify_emailand/complete_signin:code,uid, optionallyservice,redirectTo,resume. Reminders addreminder=first|second|final./complete_reset_password:uid,token,code,email,resume,emailToHashWith, optionallyserviceandredirectTo./reset_password,/settings/change_password:email./settingsand its fragments:email,uid./settings/two_step_authentication/replace_codes:low_recovery_codes=true,email,uid./report_signin:uid,unblockCode./post_verify/finish_account_setup/set_password:email,product_name,token,product_id,flowId,flowBeginTime,deviceId.- Every link gets
utm_medium=email,utm_campaign,utm_contentunless the account opted out of metrics.
Known oddities
/verify_primary_emailand/verify_secondary_emailare still derived in auth-server config, but no current email links to them./settings/account_recoveryhas a link builder in the legacy mailer, but no current template renders it.verifyShortCodeandverifyLoginCodecarry their link only in anX-Linkmail header, not in the body.