Golang Microservices Full Course #16 - Email Verification

Summary

The episode implements email verification for a Go wallet application. After registration, the app generates a one-time password (OTP), emails it to the user, and lets the user submit the code to verify their account.

Implementation

OTP storage

• Create an otp_codes table with an ID, user ID, code, purpose, expiration time, usage status, and creation time.
• Support OTP purposes such as email verification and password reset.
• Link each OTP to a user with a foreign key that cascades on user deletion.
• Create a down migration to remove the table.
• The tutorial initially used an incorrect table name, then corrected it to otp_codes.

Email delivery

• Add the SMTP host, port, and sender address to the application’s environment configuration.
• Run MailHog locally as a test SMTP server through Docker Compose.
• For production, use an external email provider such as SendGrid or Mailgun.
• Implement an email-sender interface and an SMTP implementation that formats and sends messages, with logs for successes and failures.

OTP models and repository

• Define an OTP model and repository methods to create an OTP, find an active OTP for a user, and mark an OTP as used.
• An OTP is active if it matches the user, code, and purpose; has not expired; and has not already been used.
• Generate a six-digit code using a cryptographically secure random generator.
• Set email-verification codes to expire after 15 minutes and mark them as unused when created.

Sending an OTP after registration

After a user registers successfully and the database transaction commits, the app creates and stores an email-verification OTP, then sends the code and its expiration period by email. Email delivery runs asynchronously with a background context and timeout so the registration flow does not wait indefinitely for SMTP.

Account verification

• Add an is_verified column to the users table, defaulting to false.
• Add a handler that accepts a six-character code.
• The verification service checks that the OTP is active. On success, it marks the user as verified and the OTP as used.
• The instructor discusses handling these database changes transactionally.
• The verification endpoint requires authentication, so users must log in before submitting the code.

Testing and debugging

• Use MailHog to inspect the locally sent email and retrieve the OTP.
• Check the database to confirm that the OTP was stored and that is_verified changes from false to true after verification.
• Debugging included correcting the OTP table name and fixing SMTP configuration and argument issues.
• The instructor reports that verification works and notes that the same general pattern can be adapted for password reset.

Speakers, sources, and tools

• Speaker: Tutorial instructor Ikhda Muhammad Wildani.
• Other source: An AI coding assistant or agent is asked to help with service, handler, and test-related code; it is not presented as a separate voiced speaker.
• Tools and services: Go, MySQL, Docker Compose, MailHog, SMTP, and external email providers such as SendGrid and Mailgun.