---
title: "Resend Verify"
method: POST
path: "/api/auth/resend-verify"
tags: ["auth", "billing"]
---

# Resend Verify

`POST /api/auth/resend-verify`

## Request

- Base URL: `https://www.oxfordledge.com` (the document declares no server; this is the origin it was published from)
- URL: `https://www.oxfordledge.com/api/auth/resend-verify`
- Auth: none declared

Resend the email-verification link for a given address.

CR-H9 (2026-04-30): users who hadn't verified their email had no
self-service way to get a new link if the original landed in spam
or bounced. This endpoint generates a fresh verification token
(24-hour expiry, matching the registration flow) and re-queues the
email — only when the account is still unverified.

Security: same enumeration guard + rate-limiting as resend-reset.
Already-verified and OAuth accounts silently return success (neutral).

## Response `200`

Successful Response

- AuthResendResponse: `POST /api/auth/resend-reset` and `POST /api/auth/resend-verify` response. Always returns HTTP 200 with `success: True` and a neutral message, regardless of whether the email address exists in the database. This prevents user-enumeration: an attacker cannot distinguish "email not found" from "email found, mail queued". `success` is REQUIRED — it is the only field the frontend checks to decide whether to show a "check your inbox" confirmation or surface an error toast. `error` is Optional and only present when an unexpected server-side failure occurred that prevented even attempting the send (e.g. PG completely unavailable, email service misconfigured). `message` carries the user-visible text.
  - `success` boolean, required: Always True on HTTP 200 paths. Frontend shows 'check your inbox' confirmation on True; surfaces an error toast on False.
  - `message` string, nullable: User-visible neutral confirmation, e.g. 'If an account exists with this email, we have sent a link.'
  - `error` string, nullable: Machine-readable error tag. Only present on unexpected server failures (PG down, email service mis-config). NOT set for email-not-found (that still returns success=True).

---

[API](https://skmtc.dev/oxfordledge/apis/oxford-ledge-api.md) · [All operations](https://skmtc.dev/oxfordledge/apis/oxford-ledge-api/llms.txt) · [OpenAPI document](https://skmtc.dev/oxfordledge/apis/oxford-ledge-api/revisions/e832a1260f0b?raw)