How to Test Invalid Tokens in the 2026 Chrome Email Verification API?

Reject any missing, mismatched, or unverifiable token, keep the account unverified, and fall back to your product’s existing email confirmation flow. This is the right acceptance rule when you are testing your own integration; validate the token result, account state, and fallback email as separate parts of the flow.

This guide is for developers and QA engineers reviewing account security or a staged release. It helps you confirm that a failed experimental verification path cannot bypass your existing registration checks.

Last updated October 28, 2026. The Chrome documentation and proposal were checked for the Origin Trial status, token claims, key binding, and failure fallback described here. The Chrome documentation lists October 5, 2026 as its latest update date. Review the current Chrome Email Verification documentation before testing, because the proposal can evolve.

Set the acceptance boundary before testing

Chrome Email Verification API is not proof that your application sent an email or that a person received one. The API’s role is to provide evidence that the user controls an email address within a supported provider session. Your application still needs to decide whether the token is valid and what to do if it is absent or fails validation. The documented fallback is the site’s default email confirmation flow. Chrome’s overview of the API and the WICG proposal describe this boundary.

Keep three outcomes distinct in your test evidence:

• Token validation: Did your server accept or reject the presented token according to its verifier?
• Account state: Did the intended account remain unverified unless the required proof succeeded?
• Email fallback: Could the user still complete your existing confirmation flow?

A green result for one outcome does not make the whole test pass. For example, a verifier may correctly reject a token while a faulty registration handler still marks the account as verified. Conversely, a fallback email may arrive even though the application has already changed the wrong account’s state.

The documented flow involves checking token claims, key binding, and the EVT signature. Your test should reflect the verifier your application actually implements, rather than inventing a universal response code or behavior that the proposal does not specify. See the server-side verifier guidance for the verification steps.

Scenario: the request has no EVT

A missing Email Verification Token (EVT) can occur when the integration is unavailable to a user or the expected token is not issued. Your application must not interpret an empty token field as success. The official flow describes falling back to the site’s default confirmation process when the token is missing. The Chrome documentation explains this fallback.

Test this case in an environment where you control the registration data:

1. Submit the registration form through the path that does not provide an EVT.
2. Inspect the server-side request handling and confirm that the verifier did not receive a usable token.
3. Check the page or API response shown to the user. It should explain the next action without claiming that the email address is verified.
4. Read the persisted account state. It must remain unverified until the existing confirmation mechanism succeeds.
5. Confirm that your application starts or offers its existing email confirmation flow.
6. Complete that flow using a controlled test address, then verify that only the intended account changes state.

Record the form instance, test account identifier, relevant request correlation information, verifier result, and final account state. Avoid saving full tokens or unnecessary personal data in test logs. If you need to compare how an address behaves over time, review the address lifecycle guide and keep the test address separate from production identities.

Scenario: claims do not match the registration request

A token can be present and still be unacceptable to your application. Build negative cases for the claims your verifier expects, including email, aud, nonce, iat, and exp. The exact validation boundary must match the current documented flow and your implementation; do not assume that every malformed or mismatched claim has a single mandated error response. The Chrome verifier guidance is the reference for the server-side checks.

For each case, vary one expected value at a time where possible. That helps you identify which check failed, instead of learning only that the whole token was rejected. Then repeat with combinations that matter to your integration, such as a token for a different form instance.

Nonce binding deserves particular attention. Associate the form submission with the nonce expected for that same form instance. A token tied to a different registration attempt must not verify the current account. Check both the verifier decision and the account record after processing. An HTTP response that indicates failure does not prove that your persistence layer avoided an unintended update.

Use test fixtures that do not contain real user information. Keep the email address, form instance, and account identifier clearly associated in the test run. Where your privacy review includes how test identities are created and retained, use a defined signup privacy checklist rather than copying employee or customer addresses into a test database.

Scenario: signature or key binding verification fails

A server must not accept a token when the required signature or key-binding validation fails. Test the failure path in an isolated environment with controlled fixtures. The Chrome flow describes validating the key binding and EVT signature; the WICG proposal provides the protocol context. For the meaning and structure of SD-JWT key-binding material, consult RFC 9901.

Include separate cases for a failed Key Binding JWT signature check and a failed EVT signature check if those checks are distinct in your implementation. For each case, preserve evidence that allows you to trace the request without exposing secrets:

• The test case identifier and application environment.
• The verifier stage that rejected the token.
• The account identifier or a privacy-safe test reference.
• The resulting account state.
• Whether the existing email confirmation path remained available.

Do not write an expected error code into the test unless your own service defines and documents that code. The experimental protocol’s documentation does not make every implementation-specific failure response a universal standard. A cryptographic rejection can be correct while the surrounding application still mishandles the account, so inspect the state after the registration request has completed.

Scenario: issuer discovery or key lookup does not validate

Your verifier may need to use issuer information and public keys to validate a presented token. Test cases where the discovered issuer does not correspond to the token’s iss value, or where issuer metadata or a public key cannot complete the expected validation. The expected security result is rejection, followed by your product’s existing confirmation path, as appropriate to the failure.

Do not collapse all lookup failures into “the provider issued a bad token.” A mismatch in issuer data is different from a temporary network or dependency failure. Capture which stage failed, whether the failure was a validation result or an operational error, and what the application did next. The user-facing message can be consistent while internal logs preserve enough detail for diagnosis.

For a dependency failure, make sure your application fails closed with respect to verification: it must not mark the email as verified merely because the verifier could not complete its checks. Whether you retry, show an error, or offer email confirmation depends on your application design. Do not claim a particular retry count or timing as a Chrome requirement unless the current official documentation says so.

Decision branches for test acceptance

Use these conditions to decide whether a test case passed:

• If no EVT is available, keep the account unverified and use the existing email confirmation flow.
• If any required claim, signature, key binding, issuer, or key check fails, reject the token and inspect the account state before marking the scenario complete.
• If the verifier cannot finish because a dependency is unavailable, do not treat the uncertainty as successful verification; apply your documented failure handling.
• If the token validates under your current implementation, verify that it is bound to the intended address, audience, form instance, and account before accepting the result.
• If the fallback message can be read but the wrong account changes state, the end-to-end test fails.
• If the account remains unverified but the user has no usable fallback, the security check may be correct, but the registration flow is not fully accepted.

This decision list is intentionally about the failure boundary, not token renewal or a comparison of API-based verification with traditional email. Those are separate test and product decisions.

FAQ: negative-path questions from implementation reviews

What should happen when Chrome does not return a token?

Keep the account unverified. Continue through the existing email confirmation flow instead of treating the missing value as an implicit pass. Test the visible message, the stored account state, and the fallback delivery separately. The absence of a token may reflect support or issuance conditions; it is not evidence that the user controls the address.

How should I test an unexpected email, aud, nonce, or exp value?

Make focused test cases that change one expected claim at a time, then add combinations that reflect realistic form submissions. Confirm that the server rejects each unacceptable token and that the intended account stays unverified. For nonce, include a token associated with another form instance to catch cross-request binding errors that a response-only assertion could miss.

What proves that a failed Key Binding JWT check did not verify the account?

Inspect the final application state after the request finishes, not just the verifier log. The account must remain unverified, the request should be traceable to its test case, and the existing confirmation route should remain available. Keep the test isolated and do not invent a universal error code, retry rule, or replay policy where the current protocol material does not define one.

How do I prove the email fallback works after token rejection?

Trigger a controlled failure in your own test environment. Read the resulting message using a test address, check that it belongs to the intended environment and account, and follow the confirmation link. Then verify the state transition in your application. A readable test message proves only that this test message was readable; it does not prove production delivery or inbox placement.

Verify the fallback as a separate end-to-end path

Use a controlled test address only after you have established that the token was rejected. This keeps the two assertions distinct: the API path failed closed, and the normal email path remains usable. Check the message content, destination environment, link target, and account reference. Then follow the link and confirm the expected state change in the application.

Avoid copying a real customer’s address or personal information into a fixture. A controlled inbox should make it possible to inspect the test message without involving an unrelated person or polluting a work inbox. If you are choosing between a temporary inbox, an alias, or a long-lived mailbox for the test, the inbox-or-alias guide can help you choose based on the need to retain access or reply later.

A readable message is not equivalent to production deliverability. The controlled inbox confirms that your test message was readable in that test. It does not establish that every production recipient will receive the message, that it will avoid spam filtering, or that a provider will accept the same message under different conditions.

Keep two evidence records for each failure

The first record should describe token validation and application state. The second should describe the fallback email and confirmation action. Keep the records linked by a test-case identifier, but do not store the raw EVT or other sensitive material unless your security process specifically requires it.

Do not interpret a single passing row as proof of the whole flow. The token, account, and email checks answer different questions.

Separate protocol rejection from operational failure

Use clear internal labels for validation failures and infrastructure failures. A mismatched iss claim or invalid signature is a verification failure. An unavailable metadata endpoint or key lookup dependency may be an operational failure. Both must avoid accidental account verification, but they can require different investigation and user messaging.

Your logs should make the distinction visible without exposing token contents. Record the environment, request correlation value, verifier stage, outcome category, and account state. Avoid placing full email addresses or token strings in diagnostic output when a privacy-safe test reference will do. If your implementation emits a general error to the client, retain the more specific classification in access-controlled server logs.

The protocol is described as an Origin Trial proposal in the Chrome documentation, so re-check the official material when your integration or browser test setup changes. Do not treat an unconfirmed behavior as a stable API guarantee. The Chrome Email Verification page and the WICG proposal are the sources to revisit.

Use this acceptance matrix in review

The matrix is a compact review aid, not a substitute for the full end-to-end checks above. Adapt the expected user-facing message to your product. Keep the security invariant fixed: no failed or incomplete token validation may establish email ownership.

If a test fails, preserve enough evidence to reproduce it: the scenario, test account reference, request correlation information, verifier outcome, final account state, and controlled inbox result. Keep the reproduction within your own product or an environment where you have authorization. Do not turn these tests into automated registrations on third-party services.

For a temporary registration test or a single fallback message, MyTempBox can be one controlled-inbox option when you want to avoid exposing your primary address or filling it with test mail. Use it only where your test setup accepts the address, and do not rely on a temporary inbox for accounts that require long-term recovery, replies, or durable access. The useful acceptance signal remains the same: your server rejects invalid proof, the intended account stays unverified, and your own confirmation fallback can complete the flow.

Frequently asked questions

What should my registration flow do when Chrome returns no verification token?

Treat the missing token as no proof of email ownership. Keep the account unverified and continue through your product’s existing email confirmation flow. Test this path as a complete user journey: inspect the page message, stored account state, and whether the expected confirmation email can be read in a controlled test inbox. Do not infer success from the absence of an API error.

How should I test mismatched email, aud, nonce, or exp claims in an EVT?

Create isolated test cases in which each expected claim differs from the registration request or the verifier’s configured expectations. Confirm that your server rejects the token, leaves the account unverified, and follows the intended fallback. Check the relationship between the form instance and its nonce; a rejected response alone does not prove that the wrong account was not updated.

What should I verify when a Key Binding JWT signature check fails?

Verify the negative outcome at the application boundary, not just in a cryptographic log. The account must remain unverified, the request should be traceable to the relevant test case, and the existing email confirmation route should remain available. Run this only in an isolated environment with controlled test data; do not assume the proposal defines one universal error code or retry behavior.

How can I confirm that email fallback still works after API validation fails?

Trigger the failure in your own test environment, then use a controlled address to inspect the resulting message and its destination environment. Follow the verification link and confirm that the application changes the intended account state only after the normal confirmation step. Reading a test message proves that this test message was readable; it does not establish production delivery or inbox placement.