# invalid_verification_link

The email-verification link is unknown, expired, used or no longer matches (400).

## Meaning

`POST /v1/auth/verify-email/confirm` refuses a token that expired
(`auth.email_verification.validity`), was already used, belongs to another
organization, was never issued, or was sent to an address the account no longer
holds.

## Impact

The address is not verified by this link. It is expected for an old email, a link
clicked twice, or an address changed after the link was sent.

## Diagnosis

Look the request id up on the Troubleshooting page. The refusal is recorded as
`auth.email_verification.completed` with reason `invalid_token` and cause
`verification_link_unknown`.

## Mitigation

- As a user: ask for a new link (`POST /v1/auth/verify-email/resend`, offered by the
  sign-in page) and use the newest email.
- As an operator: lengthen `auth.email_verification.validity` if links expire before
  users reach them.

## Escalation

Escalate when a fresh link to the current address is refused. Open an issue with the
request id and the server version. Never attach the link or its token.

---

[Problem code runbooks](https://www.nauthera.io/docs/v1/runbooks/problems) · Generated from [`internal/runbook/problems.yaml`](https://github.com/nauthera/nauthera-server/blob/main/internal/runbook/problems.yaml) in nauthera-server.