go-evp

Go relying-party verifier for the Email Verification Protocol (EVP).

EVP lets a browser present a cryptographic proof that the user controls an email address without sending a verification email. This package verifies the server-side token submitted by the browser.

Status

Experimental. EVP is still a draft protocol and Chrome's origin trial behavior may change. Keep this library behind a feature flag until the protocol settles.

Scope

This package verifies EVP tokens. It does not:

• create users
• issue application sessions
• send fallback emails
• implement OAuth or OpenID Connect
• implement an EVP issuer

Usage

Create a verifier:

verifier, err := evp.New(evp.Config{
	Origins: []string{"https://example.com"},
})
if err != nil {
	// handle error
}

Begin a verification attempt and render the nonce into the form:

begin, err := verifier.Begin()
if err != nil {
	// handle error
}

// Store begin.Session in a server-side session or signup intent.
// Render begin.Nonce into the hidden input's nonce attribute.

<input name="email" type="email" autocomplete="email">
<input
  name="email_verification_token"
  type="hidden"
  autocomplete="email-verification-token"
  nonce="{{ .EVPNonce }}">

Finish verification after form submission:

result, err := verifier.Finish(ctx, evp.FinishOptions{
	Email:   submittedEmail,
	Token:   submittedToken,
	Session: savedSession,
})
if err != nil {
	// fall back to your existing email verification flow
}

// result.Email is verified for this EVP attempt.

Security model

EVP proves control of an email address. It is not a replacement for an application session, password, passkey, invite gate, or account-linking policy. Applications should treat success as "this email address was verified" and then apply their own account and session rules.

References

• Email Verification API
• Email Verification Protocol draft
• Chrome origin trial article