Be part of JetBrains PHPverse 2026 on June 9 – a free online event bringing PHP devs worldwide together.

GeorgLeb's avatar

Laravel E-Mail verification always unauthenticated

Hello everyone,

I have a problem with E-Mail verification. I followed all the steps from the Laravel 11 documentation to set up the verification. Only difference is, that I do not use Blade, but a ReactJS (currently simulated by Postman) frontend. I got everything working, until the link has to be clicked. Then it says message: unauthenticated.

This is what I have:

Routing

api.php

Route::get('/email/verify', [AuthController::class, 'notice'])->middleware('auth')->name('verification.notice');
Route::get('/email/verify/{id}/{hash}', [AuthController::class, 'verify'])->middleware(['auth', 'signed'])->name('verification.verify');
// Route::get('/email/verify/{id}/{hash}', [AuthController::class, 'verify'])->middleware(['auth:sanctum', 'signed'])->name('verification.verify');

SignUp, Notice, Verify

AuthController.php

public function signup(SignUpRequest $request)
{
    $data = $request->validated();
    $user = User::create([...]);

    event(new Registered($user));

    return response()->json(['user' => 'verification e-mail sent'], 201);
}

public function notice(Request $request)
{
    return $request->user()->hasVerifiedEmail()
        ? response()->json(['user' => 'mail sent'], 201)
        : response()->json(['user' => 'mail error'], 401);
}

public function verify(EmailVerificationRequest $request)
{
    $request->fulfill();
    return redirect()->away(www.domain.com);
}

As I understand, the auth and signed middleware should allow me to access the /email/verify/{id}/{hash} route even if I am not logged in. But somehow I get an unauthenticated message if I try to verify the link in Postman.

I tried to log the user in when he signs up and use auth:sanctum instead. But this only works, if I verify the mail on the same browser/Postman-instance as the SignUp. Which makes sense. But I want to allow verification from various devices.

Am I missing something? If you need more information, just tell me. Thanks for your tips and help in advance.

0 likes
2 replies
Shivamyadav's avatar

I think you should not apply auth middleware to the email routes because user can directly access it with the token. Try this

Route::get('/email/verify', [AuthController::class, 'notice'])->name('verification.notice');
Route::get('/email/verify/{id}/{hash}', [AuthController::class, 'verify'])->middleware(['signed'])->name('verification.verify');
GeorgLeb's avatar

@Shivamyadav I already tried it like this, but the problem is, that some kind of auth is needed for the "EmailVerificationRequest" used in the verify function (which is in turn needed to check the id, hash and signature from the link).

{
    "message": "Call to a member function getKey() on null",
    "exception": "Error",
     "file": "...vendor\\laravel\\framework\\src\\Illuminate\\Foundation\\Auth\\EmailVerificationRequest.php",
    "line": 18,
    ...
}

Please or to participate in this conversation.