Chrome Email Verification API trial opens, lets sites confirm email ownership without sending messages

This WICG proposal allows the browser itself to confirm email ownership without requiring the sending of any message. The trial began in Chrome 150 on desktop, with Gmail serving as the initial provider. This mechanism replaces the typical workflow involving one-time codes or magic links.

The proposed system utilizes a three-party structure, positioning the browser between the website, termed the "verifier," and the mailbox provider, known as the "issuer." When the user is logged into their provider, the browser retrieves a signed token silently, placing it into the form for server validation upon submission. Google maintains that the issuer never learns which site initiated the request.

For front-end developers, implementation appears relatively simple, requiring an autocomplete hint in the email field alongside a hidden input containing a session-bound nonce. The more intricate tasks reside on the server side, where the token's signature must be verified against the provider's keys. Phil Nash, who created a walkthrough, has released an npm package and a Next.js example to manage this parsing and validation.

Feedback from the community has been mixed. One developer noted that "literally no worse context switch" exists than visiting an inbox during sign-up, stating email verification had cost them "dozens, maybe hundreds" of unfinished registrations. Another pointed out that verification mail often ends up in spam, making its removal a real improvement.

However, some critics found the privacy claim weak, arguing, "Make everything what works complicated. There is no advantage." They countered that "User privacy is enhanced as the issuer does not learn which web application is making the request as the request is mediated by the browser."

The API is currently an experimental feature, best employed as a progressive enhancement while the WICG gathers input from users, providers, and sites. Sites that are already testing should monitor for potential breaking changes, as Chrome's October update added Android and third-party origin trials in Chrome 154.