Resend verification email with App ID and Key

Hi,

We use email authentication to login user in Kii. Below are the questions we need help with:

Q1 - If email address is not verified, we get INVALID_GRANT. Based on this error we cannot determine if email is registered and need email verification.
We can try to get the user profile using admin token and check for verification flag. Is there any better way of doing it?

Q2 - if we are able to figure out verification status, how do we resend verification email.
We tried the way it is provided in documentation, * Authorization Basic: header for granting an anonymous access.", as we donot have user’s token.
But we get below error:
{
“errorCode”: “UNAUTHORIZED”,
“message”: “Access to this resource is forbidden within current authentication context”,
“authenticatedAppID”: “bdf72f34”,
“authenticatedPrincipalID”: “ANONYMOUS”,
“authenticatedUserID”: “ANONYMOUS”
}

Please help as we are not sure how we can handle this

Hi,

Thanks for using Kii Cloud!

Q1: E-mail address is not usable for any authentication purpose until it’s verified. Kii Cloud deals with your request to authenticate with an email that is not verified as a “wrong username”, because the email is still not attached to the relevant user. This is by design, I’m afraid. If you can identify the relevant user, an admin can check for the verification status of a given user’s email, so your approach is correct - but beware of leaking the app-admin token out of your secured boundaries, as those tokens entitle users to basically do anything with any data.

Q2: It seems you have successfully obtained a token that entitles you to use the app as ‘anonymous’ user, but this kind of token is not enough. You would need either the user’s token or an admin’s token to do it, an anonymous token is not allowed to trigger re-sending of a verification e-mail. This is also by design.

You may want to consider using ‘login name’, which doesn’t need verification and allows your users to obtain user tokens before their email is verified, and switch to using email when the verification is successful.