Skip to main content
Some chatbot tools return private account data. Examples are orders, invoices, subscriptions, tickets, and bookings. When email verification is on for a tool, BubblaV makes the visitor verify their email with a 6-digit code before the tool runs. It is on by default for integration account tools. You can turn it off for each integration.

​
When the Code Is Asked For

The chatbot asks for a code when a visitor requests account data and the visitor is not yet verified.
  1. The visitor asks, for example, “Where is my order?”
  2. The chatbot asks for the email address on the account.
  3. BubblaV emails a 6-digit code to that address. The email comes from your website name.
  4. The visitor enters the code in the verification card in the chat. The visitor can also type the code as a chat message.
  5. The chatbot runs the request for the verified email.
The chatbot does not look up any account before the visitor is verified. It does not say whether an account exists for an email.

​
Code Rules

  • The code has 6 digits.
  • The code expires after 10 minutes.
  • Each conversation allows 5 wrong codes in total. After 5, verification is locked for that conversation. The lock does not expire. The visitor can start a new conversation, but the send limits below still apply.
  • Sends are limited per hour: 3 per conversation, 5 per email address, and 10 per IP address.
  • A verified email stays verified for 24 hours for the same conversation and visitor.

​
Only the Verified Email Is Used

After verification, the chatbot looks up only the verified email. If the visitor asks about a different email, the chatbot gives a “no data” reply. The reply is the same whether or not an account exists for that email.

​
Signed Identity Skips the Code

If your site passes a signed end-user identity token with an email claim, the visitor counts as verified. No code is sent. See Identity Verification. A token without an email claim does not count. The code flow runs instead.

​
Channels

The flow is the same on every channel: website widget, WhatsApp, SMS, email, and the dashboard test chat. On WhatsApp, SMS, and email channels, the visitor types the code as a chat message. A phone number or email sender is never treated as verified.

​
Settings

1

Integrations

Open Integrations, then the integration, then the Tools section. Use the Require email verification switch. It is on by default. It applies to the integration tools that return account data.
2

Custom tools

In the custom tool wizard, open the Testing step. Turn on Require email verification. It is off by default. BubblaV fills every text parameter whose name contains email (for example customer_email or contact_email) with the verified address. If the chatbot sends a different email in any such parameter, the tool does not run.
3

MCP servers

When you add or edit an MCP server, turn on Require email verification. It is off by default. BubblaV fills every text argument whose name contains email with the verified address. If the chatbot sends a different email in any such argument, the tool does not run.
Tools that only collect data, such as contact forms, bookings, and product search, do not need a code.

​
Chatbot Log

Each decision appears in the Chatbot Log. See Chatbot Logs.
  • email_verification:<status> rows show code sends and checks.
  • identity_gate:<tool> rows show whether a tool was allowed or denied.
The log stores a hash of the email. It never stores the email or the code.