Email Verification Requirement for Member Login in SAP CDC

[Rvanjari]

Dear All , 

I am working on a scenario where a member should not be able to log in to their account until they have verified the email address they provided.

Is there a way to achieve this in SAP CDC?

Many Thanks ,

Ruchita

[KunalBansal]

Hi @Rvanjari,

In addition to @Pree1 recommendations, please also follow below in SAP CDC Console:

1. Navigate to Security Settings for the relevant site.
2. Enable the option Require verified email for login.
   

Kunal

[Rvanjari]

Hi Kunal , 

Thanks for the response , but this is not exactly what i want 

if i enable email verification required then an email is been triggered , which i dont want , i want that email verification is required without sending an email out of CDC, so if a user is not verified it should return 206 and not 200 while login

[KunalBansal]

Hi @Rvanjari, I don't think its possible, you can submit a SAP ticket to confirm with SAP. Kunal

[Preeti1]

Hi @Rvanjari,

Good day.

To enable Email Verification Flow:

1. Navigate to Identity -> Security -> Identity Verification and select either "Use Code Verification" or "Customize Redirection URL" under Email Verification. Please note that both options cannot be selected simultaneously.

2. Once this setting is configured in the console, the following server-side API calls must be made during login if the user's email is unverified, as per your requirements:

   • accounts.otp.sendCode REST
   • accounts.otp.update REST

Please note that the user will not be able to log in until this verification is successfully completed. I am not sure what you mean by "Later, an update account request will verify the email".

I hope this clarifies the process.

For more details please refer:

1.  email update
2. email code verification

Best Regards,
Preethi G
SAP CDC Consultant

[Rvanjari]

Hi Preethi ,

Thanks for your response ,

i am not using CDC email sending functionality to verify the account , i am using REST APIs to create a user (register process ) and then update the isVerified using a setaccount info , meanwhile the isverified is not true i also want to make sure the user won't be able to login using accounts.login

[KunalBansal]

Hi @Rvanjari,

I'd answer in 2 perspective as I'm not sure of your query:

1. User Console Login/Access via Admin

2. Via Screenset - Customer Login/Register

In both of the above cases, CDC doesn't allow user to login until email is verified as default settings.

Is your query different than above?

Br,

Kunal, Sol Architect 

[Rvanjari]

Hi Kunal ,

Thanks for your response ,

Indeed my query is different , its related to a REST API. If a user is created via the `account.register` endpoint and hasn't verified their email address, I want to ensure they cannot log in.

To clarify, I'm not referring to email activation through a confirmation email—this flow does not apply in my case. Instead, when the user is initially created through `account.register`, the email remains unverified. Later, an update account request will verify the email.

However, in the meantime, if the user tries to log in, they should not be allowed to authenticate, nor should any token or user details be returned.