Set up double opt-in email verification
Require participants to confirm their email address before a sign-up counts, using a Function you control.
Turn on double opt-in to hold a sign-up until the participant confirms their email address, so your contact list stays clean and you have a record of consent. OmniLab does not send the confirmation message itself — you write a small Function that decides how confirmation happens, then bind it to the organisation.
Before you begin
- You need Admin access. Turning on the setting and binding the Function both require it.
- A Function bound to the contact.verify hook point must exist before you turn double opt-in on. Without one, every affected sign-up fails.
- Decide which email service provider (ESP) — the service that actually sends the confirmation message, such as Brevo — your Function will call, and have its API credentials ready.
Bind the Function first
Once double opt-in is enabled for an organisation, OmniLab refuses every passwordless sign-up until a Function is bound to contact.verify. Set up the Function before you flip the switch, not after.
Steps
Bind a Function to the verification hook
In the left sidebar, switch to the Global Organization, then open General Settings. On the Enterprise Settings page, select the Functions tab, and create or choose a Function bound to the contact.verify hook point. This is the code that actually delivers the confirmation message — OmniLab hands it the single-use link and waits for an answer.
Your Function has two valid responses: send the link through your ESP, or tell OmniLab the contact is already verified when your own records already prove it.
Writing the Function itself
Building and testing the Function is covered in Hook functions. Share that page with your developer.
Store your provider credentials as a secret
Still on the Functions tab, add your ESP's API key as a secret bundle and bind that bundle to your Function, so the credentials are available at runtime without being written into the code. See Configure runtime and secrets for the exact fields.
Turn on double opt-in for the organisation
Open General Settings > Authentication to set the tenant-wide default, or Organization Settings > Authentication to set it for one organisation only. Set Double opt-in for passwordless sign-up to Enabled.
A per-organisation choice always wins over the tenant default, so use the organisation setting for any group that needs different behaviour.
Confirm a sign-up is actually held
Sign up with a test contact and confirm the participant is not counted until they act on the confirmation message your Function sent, or until your own system reports them already verified. Check your Function's execution log to see which of the two paths ran.
If something's blocked
- Sign-ups fail immediately. Double opt-in is on for this organisation but no Function is bound to contact.verify. Bind one, or turn the setting off until you're ready.
- A participant says the confirmation message never arrived. Open the Function's execution log for that sign-up — a successful run only means your Function's call to the ESP was accepted, not that the message was delivered. Check the ESP's own delivery logs next.
- Sign-ups succeed instantly for everyone, with no message sent. Your Function is returning already verified on every run instead of only when your own records support it. Review its logic.