In firebase auth I am able to verify a users email only after I have made it their primary email for logging in. I can change the users email this way:

var user = firebase.auth().currentUser;

user.updateEmail("[email protected]").then(function() {
  // Update successful.
}).catch(function(error) {
  // An error happened.
});

Then I can verify the email after it has been set this way:

var user = firebase.auth().currentUser;

user.sendEmailVerification().then(function() {
  // Email sent.
}).catch(function(error) {
  // An error happened.
});

What I want to do is verify the email BEFORE it is set to the users primary email.

In firebase auth I am able to verify a users email only after I have made it their primary email for logging in. I can change the users email this way:

var user = firebase.auth().currentUser;

user.updateEmail("[email protected]").then(function() {
  // Update successful.
}).catch(function(error) {
  // An error happened.
});

Then I can verify the email after it has been set this way:

var user = firebase.auth().currentUser;

user.sendEmailVerification().then(function() {
  // Email sent.
}).catch(function(error) {
  // An error happened.
});

What I want to do is verify the email BEFORE it is set to the users primary email.

• javascript
• firebase
• firebase-authentication

2 Answers 2

Yeah, you have the ability to change the email only after it is verified. The API is not well documented. You can do it via verifyBeforeUpdateEmail.

firebase.auth().currentUser.verifyBeforeUpdateEmail('[email protected]')
  .then(function() {
    // Verification email sent.
    /  When the user clicks the email link,
    // it will update to [email protected] and set it as verified,
    // emailVerified: true.
    // Until then, the old email remains on the account.
  })
  .catch(function(error) {
    // Error occurred. Inspect error.code.
  });

Chipping in from April 2023, firebase 9.9.0 (angular/fire 7.4.1), this seems to work for me on my Angular project. I can:

1. login with Phone authentication, currentUser is as expected:

email: null,
phoneNumber: "+47987654321"

2. call verifyBeforeUpdateEmail() with some email -> I get a mail with an email link, click it, get the message I can now login. Login and currentUser is as expected:

email: "[email protected]",
phoneNumber: "+47987654321",
providerData: [
  {providerid:"phone" …},
  {
    providerid:"password" // yeah it's password also for passwordless :)
    email: "[email protected]"
  }
]

3. call verifyBeforeUpdateEmail() with some OTHER email -> I get a mail with an email link, click it, get the message I can now login. Login and currentUser is as expected:

email: "[email protected]",
phoneNumber: "+47987654321",
providerData: [
 {providerid:"phone" …},
 {
   providerid:"password",
   email: "[email protected]"
 }
]

…annnd there's still exactly two entries to providerData, but there's no trace of the original [email protected] in the currentUser anymore.

-- Unless I misunderstood this thread I think it now works :) Anyway, it put me on the right track, so thanks!