Don't change the email in db before it's validated.
The process is well explained in the doc
https://laravel.com/docs/9.x/verification
https://laravel.com/docs/9.x/verification#the-email-verification-handler
Be part of JetBrains PHPverse 2026 on June 9 – a free online event bringing PHP devs worldwide together.
I am working on a project in Laravel 9 and I want to let users change their email address at any time. Technically I let them change their email when they are logged in!
When they change their email address, it changes just in database, but since user has logged in, I want to change user's email address in logged in session token.
In fact, I want to regenerate login token (remember me token) with new user's new email.
I'm not using any kind of specific API for this process.
In this project, for some pages, verified email address is not 100 percent required so if someone updates their email address, I want to regenerate login token with their new/updated email. In this case, I don't need to get user's data from database every time! Instead, I use auth()->user().
Up to this point, I used below piece of code to update user's email address:
$request->validate(['email' => 'required|email|min:12|max:64']);
$user->forceFill([
'email' => $request->email_confirmation,
'email_verified_at' => null
])->setRememberToken(Str::random(60));
When I print authenticated user's email like what you see down below, it shows old email not the new one! If anyone knows a way to do this thing please comments below. Thank you
return response()->json([
'code' => 200,
'message' => 'An email verification link has been sent to <strong>'.auth()->user()->email.'</strong>.
<br/>Please follow the link and verify your email.
]);
Technically I let them change their email when they are logged in!
How else could you do it?
change your json response message to use the email from the request not the one from the user model
on the next request cycle, the new email will be loaded
don't forget to validate the new email and make sure it does not belong to someone else. Probably also a good idea to get them to provide their password for checking
Please or to participate in this conversation.