I am using Craft CMS as a backend for react Next app. On our live site we are sometimes getting complaints from the user about error when user try to verify code sent in the email.

This case doesn't happen with every user but very for random users. For this reason I am not able to find the reason for the issue and fix it.
Everytime I see following information in the log file.

2020-05-27 10:17:35 [-][-][-][warning][craft\services\Users::isVerificationCodeValidForUser] The verification code (gqkZpvgTZDMNSXRyNuXE4ksxpNOlBOl) given for userId: 99965 does not match the hash in the database. 2020-05-27 10:17:35 [-][-][-][info][application] $_GET = [ 'p' => 'ACT/craft-rest-api/user/verify-email' 'code' => 'gqkZpvgTZDMNSXRyNuXE4ksxpNOlBOl' 'id' => 'ef2156d6-306b-4a88-80bb-25ca26562702' ]

Here is the information about the system.

PHP version 7.4.5

OS version Linux 3.10.0-1127.el7.x86_64

Database driver & version MySQL 8.0.20

Image driver & version GD 7.4.5

Craft edition & version Craft Pro 3.4.21

Yii version 2.0.35

Twig version 2.12.5

Guzzle version 6.5.4

Imagine version 1.2.3-dev


Amazon S3 1.2.8

Architect 2.3.3

CKEditor 1.0.0-beta.3

Comments 1.5.6

Contact Form 2.2.7

Craft-Rest-Api 1.1.0

Enforce password 1.0.0

Image Resizer 2.0.9

Klaviyo Connect

Redactor 2.6.1

SendGrid 1.2.0

  • What's verificationCodeDuration set to? May 31, 2020 at 19:53

1 Answer 1


Those codes are valid for as long as whatever verificationCodeDuration is set to (24 hours by default).

Guessing the users that are getting that are hitting expired verification codes.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.