---
title: "Begins the validation process for an email to be used during registration."
method: POST
path: "/_matrix/client/v3/register/email/requestToken"
tags: ["Account management"]
---

# Begins the validation process for an email to be used during registration.

`POST /_matrix/client/v3/register/email/requestToken`

## Request

- Base URL: `https://matrix.org`
- URL: `https://matrix.org/_matrix/client/v3/register/email/requestToken`
- Auth: none declared
- TypeScript: <https://skmtc.dev/matrix/apis/matrix-client-server-api/docs/_matrix/client/v3/register/email/requestToken/post.ts> (a function with typed inputs; its response is checked against the schema)

The homeserver must check that the given email address is **not**
already associated with an account on this homeserver. The homeserver
should validate the email itself, either by sending a validation email
itself or by using a service it has control over.

## Request body

- object
  - `client_secret` string, required: A unique string generated by the client, and used to identify the validation attempt. It must be a string consisting of the characters `[0-9a-zA-Z.=_-]`. Its length must not exceed 255 characters and it must not be empty.
  - `email` string, email, required: The email address to validate.
  - `next_link` string, uri: Optional. When the validation is completed, the identity server will redirect the user to this URL. This option is ignored when submitting 3PID validation information through a POST request.
  - `send_attempt` integer, required: The server will only send an email if the `send_attempt` is a number greater than the most recent one which it has seen, scoped to that `email` + `client_secret` pair. This is to avoid repeatedly sending the same email in the case of request retries between the POSTing user and the identity server. The client should increment this value if they desire a new email (e.g. a reminder) to be sent. If they do not, the server should respond with success but not resend the email.
  - `id_access_token` string: An access token previously registered with the identity server. Servers can treat this as optional to distinguish between r0.5-compatible clients and this specification version. Required if an `id_server` is supplied.
  - `id_server` string: The hostname of the identity server to communicate with. May optionally include a port. This parameter is ignored when the homeserver handles 3PID verification. This parameter is deprecated with a plan to be removed in a future specification version for `/account/password` and `/register` requests.

## Response `200`

An email has been sent to the specified address. Note that this
may be an email containing the validation token or it may be
informing the user of an error.

- object
  - `sid` string, required: The session ID. Session IDs are opaque strings that must consist entirely of the characters `[0-9a-zA-Z.=_-]`. Their length must not exceed 255 characters and they must not be empty.
  - `submit_url` string, uri: An optional field containing a URL where the client must submit the validation token, with identical request and response parameters and error codes to the Identity Service API's [`POST /validate/email/submitToken`](https://spec.matrix.org/v1.19/identity-service-api/#post_matrixidentityv2validateemailsubmittoken) and [`POST /validate/msisdn/submitToken`](https://spec.matrix.org/v1.19/identity-service-api/#post_matrixidentityv2validatemsisdnsubmittoken) endpoints (without the requirement for an access token). The homeserver must send this token to the user (if applicable), who should then be prompted to provide it to the client. If this field is not present, the client can assume that verification will happen without the client's involvement provided the homeserver advertises a sufficiently recent version in the [`GET /versions`](https://spec.matrix.org/v1.19/client-server-api/#get_matrixclientversions) response (ie: r0.5.0).

## Other responses

- `400`: Part of the request was invalid. This may include one of the following error codes: * `M_THREEPID_IN_USE` : The email address is already registered to an account on this server. However, if the homeserver has the ability to send email, it is recommended that the server instead send an email to the user with instructions on how to reset their password. This prevents malicious parties from being able to determine if a given email address has an account on the homeserver in question. * `M_SERVER_NOT_TRUSTED` : The `id_server` parameter refers to an identity server that is not trusted by this homeserver.
- `403`: The homeserver does not permit the address to be bound.

---

[API](https://skmtc.dev/matrix/apis/matrix-client-server-api.md) - [All operations](https://skmtc.dev/matrix/apis/matrix-client-server-api/llms.txt) - [OpenAPI document](https://skmtc.dev/matrix/apis/matrix-client-server-api/revisions/c7fe4072c681?raw)