> ## Documentation Index
> Fetch the complete documentation index at: https://docs.bubblav.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Email Verification

> Make visitors verify their email with a 6-digit code before the chatbot shows account data

Some chatbot tools return private account data. Examples are orders, invoices, subscriptions, tickets, and bookings. When email verification is on for a tool, BubblaV makes the visitor verify their email with a 6-digit code before the tool runs. It is on by default for integration account tools. You can turn it off for each integration.

## When the Code Is Asked For

The chatbot asks for a code when a visitor requests account data and the visitor is not yet verified.

1. The visitor asks, for example, "Where is my order?"
2. The chatbot asks for the email address on the account.
3. BubblaV emails a 6-digit code to that address. The email comes from your website name.
4. The visitor enters the code in the verification card in the chat. The visitor can also type the code as a chat message.
5. The chatbot runs the request for the verified email.

The chatbot does not look up any account before the visitor is verified. It does not say whether an account exists for an email.

## Code Rules

* The code has 6 digits.
* The code expires after 10 minutes.
* Each conversation allows 5 wrong codes in total. After 5, verification is locked for that conversation. The lock does not expire. The visitor can start a new conversation, but the send limits below still apply.
* Sends are limited per hour: 3 per conversation, 5 per email address, and 10 per IP address.
* A verified email stays verified for 24 hours for the same conversation and visitor.

## Only the Verified Email Is Used

After verification, the chatbot looks up only the verified email. If the visitor asks about a different email, the chatbot gives a "no data" reply. The reply is the same whether or not an account exists for that email.

## Signed Identity Skips the Code

If your site passes a signed end-user identity token with an `email` claim, the visitor counts as verified. No code is sent. See [Identity Verification](https://docs.bubblav.com/developer-guide/in-app-chatbot-integration.md). A token without an `email` claim does not count. The code flow runs instead.

## Channels

The flow is the same on every channel: website widget, WhatsApp, SMS, email, and the dashboard test chat. On WhatsApp, SMS, and email channels, the visitor types the code as a chat message. A phone number or email sender is never treated as verified.

## Settings

**1. Integrations**

Open **Integrations**, then the integration, then the **Tools** section. Use the **Require email verification** switch. It is on by default. It applies to the integration tools that return account data.

**2. Custom tools**

In the custom tool wizard, open the **Testing** step. Turn on **Require email verification**. It is off by default. BubblaV fills every text parameter whose name contains `email` (for example `customer_email` or `contact_email`) with the verified address. If the chatbot sends a different email in any such parameter, the tool does not run.

**3. MCP servers**

When you add or edit an MCP server, turn on **Require email verification**. It is off by default. BubblaV fills every text argument whose name contains `email` with the verified address. If the chatbot sends a different email in any such argument, the tool does not run.

> [!NOTE]
>
> Tools that only collect data, such as contact forms, bookings, and product search, do not need a code.

## Chatbot Log

Each decision appears in the Chatbot Log. See [Chatbot Logs](https://docs.bubblav.com/developer-guide/chatbot-logs.md).

* `email_verification:<status>` rows show code sends and checks.
* `identity_gate:<tool>` rows show whether a tool was allowed or denied.

The log stores a hash of the email. It never stores the email or the code.


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.