Email verification is often implemented as a single request: create a user, send a message, and wait for a click. That model breaks down when the client times out after the server has already accepted the request. A retry can create a second token, send a second message, or attach the wrong result to the user.

The fix is to make verification intent idempotent. The API should treat repeated requests as a lookup for the same operation, while PostgreSQL enforces the uniqueness that application code alone can miss.

This matters in both production authentication flows and automated tests that use a free throwaway email or a throwaway email address. A test mailbox is useful only when the API can explain which verification attempt produced the message.

Why verification retries create duplicate work

Suppose a client sends POST /verification-requests and waits six seconds. The server commits the request, but the response is lost.…