What does the email confirmation link do when I click it?

When you sign up for Valid Email Checker, your account is created in a half-finished state. The email and password are saved on our side, but the account is marked unverified until you prove that you actually own the address you typed in. Clicking the confirmation link in the email we send is what flips your account from unverified to verified, and a few other things happen at the same moment.

What happens server-side the instant you click

The confirmation link is a one-time URL that points at /auth/callback on our app with a signed token attached. When you click it, we validate the token, mark your email as confirmed in our auth system, and briefly establish a session on your behalf. That session lasts just long enough to do three things in sequence.

1. Email confirmed. Future logins skip the "please verify your address" wall. You can sign in normally with email and password.
2. 200 welcome credits deposited. The credits land in your Pay-As-You-Go bucket. The balance widget in the sidebar updates to 200 the next time you load the dashboard.
3. Welcome bonus logged. A welcome_bonus row appears in your Credits History so you can see exactly when the grant happened and how many credits it added.

Where you land next

After the grant runs, we sign you out and redirect you to the login page at /auth/login. This is deliberate. We do not want to leave a half-established session sitting in your browser, so we end it cleanly and let you log in fresh with your password. From there it is the normal login flow: enter your credentials, pass the 2FA challenge if you set one up, and you land on the dashboard at /overview with your 200 credits already loaded.

If the link never arrived or looks broken

Check your spam folder first. If the email is not there, the login page has a "Resend confirmation" link that fires a fresh magic-link email. The new link invalidates any previous one, so always click the most recent email. Some corporate mail servers pre-fetch or strip authentication URLs on inbound scans, which can burn the one-time token before you ever click it. If you suspect that is the issue, sign up again with a personal address.