# Email verification for AI agents: which mail works, how fast

Which sign-up verification mail our AI agent finished without a browser, how fast the mail reached its inbox, and what to change in your own flow.

Source: https://agentdrives.com/guides/email-verification-for-ai-agents?via=md · Published 2026-10-29

One plain HTTP request to the link confirmed the account at 8 of 34 products whose sign-up mail held only a link. No page to load, no code to type. In all, our agent finished email verification without a browser at 9 of 63 products whose mail we timed.

## Which mail our agent finished without a browser

We timed the first sign-up mail at 63 products. 34 of 63 carried a link only. The others carried a code, or a code and a link.

Where a link-only mail did not finish over plain HTTP, our agent needed a real browser or stopped there. The split for every mail type, codes included, is on our [email verification findings](/findings/email-verification).

## How fast the mail arrived

The median wait was 13 seconds, from the step that sent the mail to its arrival in our agent's inbox. The slowest took 88 seconds.

**How soon the sign-up mail reached our agent's inbox**

|   | Products | Out of | Share |
| --- | --- | --- | --- |
| Within 10 seconds | 23 | 63 | 37% |
| Within 20 seconds | 51 | 63 | 81% |
| Within a minute | 61 | 63 | 97% |


## What to change in your product

Make the link do the whole job: opened once, it confirms the account and returns a usable session. Then check what your auth provider does by default:

- **Supabase Auth.** Its passwordless method is called "OTP", but "it sends a Magic Link by default." To send a code instead, you change the email template. Its magic links work once ([supabase.com](https://supabase.com/docs/guides/auth/auth-email-passwordless)).
- **Stytch Email Magic Links.** In the default flow, "the browser will direct the user to stytch.com which renders as a blank page" before it redirects to your app. The step is there to stop bot traffic. Stytch also notes that mail scanners follow links in an email, and since a token works once, "now the link is no longer valid" for the real user ([stytch.com](https://stytch.com/docs/consumer-auth/authentication/magic-links/redirect-routing)).
- **Auth0.** For magic links with Classic Login, "both the initial request and its response must take place in the same browser or the transaction will fail" ([auth0.com](https://auth0.com/docs/authenticate/passwordless/authentication-methods/email-magic-link)).
- **Firebase Auth.** Its guide suggests storing the email address locally and asking for it again when the link opens on another device ([firebase.google.com](https://firebase.google.com/docs/auth/web/email-link-auth)).

Every number here links to its definition in [our data](/data/facts), and how our agent drives a sign-up is in our [method](/method).

## Questions

**Should my verification mail send a link or a code if I want AI agents to get through?**

A link, as long as opening it is enough to confirm the account. Check that your auth provider puts no blank redirect page, same-browser rule or one-time token a mail scanner can spend in its way.

**How do I test whether an AI agent can finish my email verification?**

Sign up, take the link from the mail and request it once with a plain HTTP client such as curl. If the account is confirmed and a session comes back, an agent can do the same.