PHPackages                             svss-labs/email-verification-api - PHPackages - PHPackages  [Skip to content](#main-content)[PHPackages](/)[Directory](/)[Categories](/categories)[Trending](/trending)[Leaderboard](/leaderboard)[Changelog](/changelog)[Analyze](/analyze)[Collections](/collections)[Log in](/login)[Sign up](/register)

1. [Directory](/)
2. /
3. [Authentication & Authorization](/categories/authentication)
4. /
5. svss-labs/email-verification-api

ActiveLibrary[Authentication & Authorization](/categories/authentication)

svss-labs/email-verification-api
================================

Verify Email Verification Protocol (EVT+KB) tokens issued by email providers like Gmail

v0.1.0(today)10MITPHPPHP >=8.3CI passing

Since Aug 26Pushed todayCompare

[ Source](https://github.com/svss-labs/email-verification-api)[ Packagist](https://packagist.org/packages/svss-labs/email-verification-api)[ RSS](/packages/svss-labs-email-verification-api/feed)WikiDiscussions main Synced today

READMEChangelogDependencies (5)Versions (2)Used By (0)

📧 ✅ Email Verification API for PHP
==================================

[](#--email-verification-api-for-php)

A PHP library to verify **Email Verification Tokens (EVT)** issued through the [Email Verification Protocol](https://github.com/WICG/email-verification) — the proposed web standard that lets browsers verify a user's email address with their email provider directly, without one-time passwords (OTPs) or magic links.

The user picks their email address in a form, the browser obtains a cryptographically signed token from their email provider (e.g. Gmail), and your server verifies it with this package. No email is ever sent.

Requirements
------------

[](#requirements)

- PHP **8.3+**
- Composer
- PHP extensions: `curl`, `gmp`, `openssl`, `sodium` (standard on most hosts; `sodium` and `gmp` are required for Ed25519 signature verification and safe IP arithmetic)

Installation
------------

[](#installation)

```
composer require svss-labs/email-verification-api
```

How the protocol works
----------------------

[](#how-the-protocol-works)

1. Your site renders a form with a **hidden field carrying a per-render nonce**.
2. The user enters (or autocomplete-selects) their email address.
3. The **browser** discovers the issuer via a DNS TXT record (`_email-verification.`), confirms the user's session with the provider, and obtains a signed token.
4. On form submit, the browser attaches the token (an SD-JWT with a Key Binding JWT) to the hidden field.
5. Your **server** verifies the full package: parsing → expected values (email/nonce/audience/age) → DNS delegation → issuer signature (metadata + JWKS) → key binding.

Full protocol details: [Chrome developer article](https://developer.chrome.com/blog/email-verification-protocol-origin-trial).

Usage
-----

[](#usage)

```