What this does

By default, when Allow user to sign up with Email is on, anyone can sign up with
just an email address and password — and they’re signed in right away. Turn on
Require email validation during account setup and you add one more step: MAM Suite
emails the new user a verification code, and until they type that code back into the
app, their account isn’t treated as verified.

Reach for this setting whenever your app sends email, keeps anything behind a logged-in
account, or you’d simply rather keep fake and mistyped addresses out of your user list.

The setting label in the admin reads “Require email validation during account
setup.” The underlying setting is sign_up_with_email_validation (Yes/No, global —
it applies to every role, not per-button).

Before you start

• The app needs a Login button placed somewhere in the app (main tab bar or left
  menu). The login-related settings, including this one, are owned by that Login button.
  See Content class: Login button.
• Allow user to sign up with Email (sign_up_with_email) must be on. Email
  validation only applies to the email signup path — it does not affect Apple/Google
  social signup, which arrives already verified by the provider.
• Outgoing email must work on the site. The verification code is delivered as a normal
  WordPress email (configure SMTP if your host does not send mail reliably). If email
  does not leave the site, users will create accounts they can never verify.

Steps

1. Head into Mobile App Manager, open App Setup, and select the Login button
   you placed in the app.
2. Open that button’s settings and look for the Login Settings group.
3. Make sure Allow user to sign up with Email is already set to Yes.
4. Set Require email validation during account setup to Yes.
5. Save the button settings.

Want to fine-tune the wording users see during the code step? These three settings live
in that same Login Settings group:

• Send Code Button Title (login_send_code_button_title) — label on the button that
  sends/resends the code, e.g. “Send Code”.
• Sign Up Code Placeholder (login_sign_up_code_placeholder) — placeholder inside
  the code-entry field, e.g. “Enter your 6-digit code”.
• Sign Up Code Reminder (login_sign_up_code_reminder) — helper text near the field,
  e.g. “Check your email for the code we just sent.”

What the user experiences

1. The user taps Sign up with Email, then fills in an email address and password.
2. WordPress creates the account right away, but flags it unverified, and MAM Suite
   emails a verification code to the address they entered.
3. Instead of signing them straight in, the app shows the code-entry screen with the
   message “We have sent a verification code to your email to complete signup.”
4. The user enters the code from that email, and once it matches, the account is marked
   verified and they’re signed in automatically.
5. If they try to sign in again before verifying, login is refused and they’re prompted
   to verify the email address instead (the Forgot Password flow also marks the
   email verified).

Codes don’t last forever — once one expires, it’s rejected and the user needs to request
a fresh one.

How it works under the hood

• When someone signs up by email, the login handler creates the WordPress user, then
  reads tsl-sign_up_with_email_validation for the active Login button through the
  mam_app_settings_get_setting filter.
• If that setting is Yes, the new user’s mam_email_verified user meta is set to
  no, a verification code is stored as user meta with an expiry, and the response tells
  the app that verification is required instead of logging the user straight in.
• That code goes out through the notification dispatcher, using the
  mam-user-roles-login-with-email notification type (listed in the notification
  registry as User Roles – Signup Email Verification).
• When the user submits their code, the handler compares it against the stored value
  (normalizing dash vs. no-dash) and checks whether it’s expired. On success, it sets
  mam_email_verified to yes, clears the stored code, and logs the user in
  automatically.
• Social signup (Apple/Google) and a successful password login both set
  mam_email_verified to yes directly, so neither path is affected by this toggle.

Customizing the verification email

The verification email is just a standard MAM notification type, so you can edit its
subject and body like you would any other notification. In the notifications admin, look
for the User Roles – Signup Email Verification notification
(mam-user-roles-login-with-email). The code arrives by way of a passwordcode
replacement token — keep that token in the body, or the user’s email will show up
without the code they need.

For the mechanics of editing a notification template, see Notifications overview and
the Notification types registry.

Troubleshooting

• Users never get the code. This almost always means email isn’t leaving the site —
  check outgoing mail and SMTP, then re-test with a real inbox. Keep in mind the signup
  itself still succeeds even when the email fails, so a user can end up stranded,
  unverified, without ever knowing why.
• “Email address not verified” on login. This user created their account while
  validation was switched on but never got around to entering a code. They’re not stuck —
  running through Forgot Password resets the password and marks the email verified
  in the same step.
• Code says expired. Verification codes only last so long. Have the user tap the Send
  Code button for a fresh one and enter it right away.
• Social signups skip the step. That’s expected: Apple and Google identities arrive
  already verified by the provider, so there’s no code step for them to go through.

Related articles

• Content class: Login button
• App setting: Allow user to sign up with Email (sign_up_with_email)
• App setting: Require email validation during account setup (sign_up_with_email_validation)
• App setting: Send Code Button Title, Sign Up Code Placeholder, Sign Up Code Reminder
• Notifications overview
• Notification types registry

Verification

This draft was grounded against:

• mam-main/includes/content-classes/local-app-login-class.php — setting definition
  (sign_up_with_email_validation, label “Require email validation during account
  setup”, Yes/No, global).
• mam-main/includes/user-roles/login-manager.php — signup → verification branch,
  mam_email_verified meta, code storage/expiry, mam-user-roles-login-with-email
  notification, and the unverified-login refusal message.
• mam-main/user_docs/05b-notification-types-registry.md — notification label User
  Roles – Signup Email Verification.
• App-setting docs under app-setting-docs/login/.

Re-verify if the Login button’s app_settings() list changes, the signup verification
branch in login-manager.php changes, or the notification type slug/label changes.