My requirement is as follows: In my web application, users register their emailIds. I have a basic regex validation handled for that, but i also want to check if their mailIds are valid without sending a mail.
Verification should be such that when user clicks on verify-email-id in the web app, it should redirect to 2FA in gmail where the user should get a 2 digit number and the web app should also receive it, the user should then enter the number and then if it matches, add that to validated mailIds.
I have been looking up about this, but havent found much help online. Can this approach be implemented or is there any other way to programatically validate emailIds using Gmail API ?
CodePudding user response：
To verify an email exists you should send an email to the account and have them click a verify email response.
Verification should be such that when user clicks on verify-email-id in the web app, it should redirect to 2FA in gmail where the user should get a 2 digit number and the web app should also receive it, the user should then enter the number and then if it matches, add that to validated mailIds.
That's not verifying an email that's verifying a google account exits. By asking the user to login to their account. What you want to do is not going to work. The login and authorization flow is handled on googles authorization server. This isn't something your going to see. Google will return to you an Id_token with claims to show you who the user is. That is all.
If you want to enable 2fa in your system your going to have to do it on your own authorization server.
programatically validate emailIds using Gmail API
This is out of scope for the gmail api. To get access to the gmail api your going to have to request authorization of the user, just to see that they have a valid email this is over kill. Even the read only gmail scope is restricted. The verification process for your app is going to be very complicated and expensive just to see if the email exits. Google probably wont approve the app anyway as this is not a valid use case for the gmail api.
Again The best way to verify an email account exists, is to send an email.