From sign-up to your first listing live: what actually happens behind the "Verify email" screen

You register, you land on a screen asking for a six-digit code, and nothing else happens until you type it in. It feels like a wall. It is actually a fairly careful piece of engineering doing three things at once: creating your account safely, connecting you to any team that already invited you, and setting up the trust signal your first listing will need later.

When you submit the sign-up form, the backend first checks whether your email already has a Firebase account. If not, it creates one. Only after that succeeds does it open a database transaction that creates your user row, generates a six-digit verification code valid for 60 minutes, and checks whether anyone had already invited that email address to an organization before you signed up. If a colleague sent you an invite last week and you're only registering today, that invitation is accepted automatically as part of the same transaction — you land in the dashboard already a member, with no separate "enter your invite code" step.

If any part of that transaction fails, the whole thing rolls back, including deleting the Firebase account it just created. You don't end up with a half-registered account that exists in one system but not the other. That's deliberate: a registration that partially succeeds is worse than one that visibly fails and lets you try again.

The welcome email is sent after the transaction commits, with the six-digit code embedded both as text and as a link parameter, so you can either type the code manually or click through and have it filled in for you. The resend button is capped at one attempt every 180 seconds, which is long enough to stop accidental double-sends but short enough that a real delivery delay from your mail provider doesn't leave you stuck.

Nothing about the registration flow marks your account verified until you supply that code. Onboarding treats "verify email" as a single gating step: the app checks your emailVerified flag, and if it's false, that's the only route available to you. This isn't friction for its own sake. An unverified email means the platform can't reliably reach you if a buyer contacts you, and it means anyone could have typed your address into someone else's project. Gating publishing on a confirmed inbox is a basic anti-fraud measure that costs you one code entry.

Once you confirm the code, the backend flips your email_verified flag and that's it for the onboarding step. But that flag doesn't stop mattering after this screen. Every listing you publish later gets scored against a quality rubric, and a verified email is worth three points in that score's trust section, no different from adding a phone number. It's a small piece of a bigger number, but it's the one piece that costs you nothing extra to earn: you already did the work by finishing this screen.

Don't use a disposable or shared inbox for your seller account. Beyond the obvious trust cost, the resend cooldown and the 60-minute code expiry are built around the assumption you can access your inbox within the hour. If your registered address is one you check once a week, you'll be re-requesting codes on a loop for no good reason.

If you're stuck on this screen right now: check spam, wait out the 180-second cooldown before hammering resend, and if you got here through a teammate's invite, know that the invite was already applied the moment you registered — you don't need to enter anything else once the code clears.