How Sign-Up and Email Verification Actually Work

Signing up looks like a single step: type an email and a password, then check your inbox. Behind that form, though, several things happen in a specific order, and that order explains the messages you see along the way. The confirmation email can be late, a link can be expired, or sign-in can be refused even though your password is right. Each of these has a concrete cause, and none of them puts your account at risk.

Your Account and Your Workspace Are Created Together

When the sign-up request arrives, the server first checks that the email address is well-formed and that no account already uses it. Your password is then hashed with bcrypt before anything is stored, so the plain-text password never reaches the database. After that, three records are written inside one database transaction: your user record, a workspace called "Personal Workspace" that you own, and a membership row that makes you the admin of that workspace.

The transaction is the important part. Either all three records exist or none of them do. You can't end up with an account that has no workspace, or a workspace with no owner, because a failure halfway through rolls the whole thing back. That's why the first time you open the dashboard, everything (invoices, clients, reports) already has a place to live. You never have to set up a workspace before you can start working.

The Verification Email Is Sent After the Account Exists

The verification email goes out only after the transaction has committed. The link inside contains a random 32-byte token, generated fresh for your account and stored next to the time it was sent. If the mail server is slow or briefly unavailable, sign-up still succeeds. The account is created, and you see the message asking you to check your email. A delivery hiccup doesn't throw away your sign-up. It just means you may need to ask for the email again.

Why the Link Lasts 24 Hours, and What Happens After

When you click the link, the server looks up the token and compares the time it was sent with the current time. If less than 24 hours have passed, your account is marked verified, the time of verification is recorded, and the token is cleared so the same link can't be used again.

If more than 24 hours have passed and your account still isn't verified, you don't simply get an error. The server generates a new token, resets the sent-time, and emails you a new link straight away. The page then tells you the old link expired and that a new one is in your inbox. In practice, an old verification email recovers itself: clicking it is enough to get a working one.

There is also a separate "resend verification" action for when the first email never arrives. It issues a new token as well, which replaces the old one. So if you request several emails, only the most recent link will work.

Clicking a Link Twice Doesn't Cause a Problem

People often click a verification link twice, for example once on their phone and once on their laptop. The second click finds no matching token, because it was cleared on the first. Instead of showing a bare "invalid token" message, the server also checks the email address included in the link. If that account is already verified, you're told so and directed to sign in. The same applies if you ask for a resend on an account that's already verified: you're told verification is done, and no new email is sent.

Why Sign-In Waits for Verification

If you try to sign in before verifying, the server checks your email and password first and only then looks at your verification status. A wrong password always gets the same generic "invalid credentials" message. You only see "please verify your email" after the password has proven the account is yours. This order means the verification message can't be used to find out whether an address has a half-finished account, because someone without the password never gets that far.

Verification matters because a verified address is where invoices, payment reminders, workspace invitations, and comment notifications are delivered. Confirming it at the start means those messages reach you.

The Short Version

Sign-up creates your account, a personal workspace, and your admin membership in one transaction, then emails a verification link that works for 24 hours. An expired link sends you a replacement automatically, a link clicked twice tells you you're already verified, and sign-in only asks you to verify after your password has been checked. If something seems stuck, the quickest fix is usually to click the newest link in your inbox, or request a resend and use that one.