Change Email

What it is used for

Lets the logged-in user replace their account email. A code is sent to the current email; the user enters that code and the new email. A second code is sent to the new email; the user confirms on a dedicated page. This ensures only someone with access to both inboxes can change the address.

User flow (what the user will do)

Page paths: /[locale]/change-email, /[locale]/change-email/form, /[locale]/change-email/confirm

1. Start change email From the account page, the user clicks Change Email (e.g. in the email row).

2. Request a code to current email The user clicks “Request verification code”. A code is sent to their current email address.

3. Enter new email and code The user enters the new email they want and the code they received at their current email, then submits. On success, they are redirected to a confirmation page.

4. Confirm with code at new email On the confirm page, the new email is shown (read-only). The user enters the code that was sent to that new address and submits. On success, the email is updated and they are redirected (e.g. to home).

How it is implemented

• Routes: /[locale]/change-email, /[locale]/change-email/form, /[locale]/change-email/confirm.
• Entry point: Account page -> Email row -> Change Email button.
• UI: src/containers/ChangeEmail/index.tsx, src/containers/ChangeEmailConfirm/index.tsx.
• API flow:
  1. Request code: User clicks “Request verification code”.
     • POST users/logged_user/change_email/request (no body).
     • Backend sends a code to the current email.
  2. Submit: User enters new email and code from current email.
     • POST users/logged_user/change_email with body { code, newEmail, recaptcha_token }.
     • On success: toast and redirect to /[locale]/change-email/confirm?email=<newEmail>.
  3. Confirm: On the confirm page, the new email is shown (disabled). User enters the code received at the new email.
     • POST users/logged_user/change_email/confirm with body { code, newEmail, recaptcha_token }.
     • On success: toast and redirect to home (/).
• API: Calls are made via CallAPI from the containers; endpoints: change_email/request, change_email, change_email/confirm.
• reCAPTCHA: Required on both submit and confirm steps (token in body). Request step has no recaptcha in the request.
• Translations: ChangeEmail namespace (including confirm-page keys).

Account flows index