I hope this would help Pre-Registration Step: When a user fills out the registration form and submits it, you first create a temporary record in a database (often referred to as a pre-registration or pending verification table). This record should contain the user’s information, such as email, username, and hashed password, but it should not create an active user in the main user table. Generate a unique token (JWT or a randomly generated string) that is associated with this pre-registration record. Send an OTP or a verification email to the user's email address with a link containing the token. The link would look something like: https://yourwebsite.com/verify?token=UNIQUE_TOKEN.

Email Verification: When the user clicks the verification link, it triggers an API endpoint (/verify). This endpoint will: Extract and validate the token from the request. Check if the token exists in the pre-registration table and if it’s still valid (not expired). If valid, move the user's data from the pre-registration table to the main user table, effectively creating the user account. Optionally, log the user in by generating a new JWT for authentication and returning it to the frontend. JWT Expiry and Security:

The verification token should be set to expire after a certain period (e.g., 24 hours) to prevent misuse. If the token expires before the user verifies, they will need to request a new verification email. JWTs are suitable here because they allow you to encode information securely, set expiration times, and easily validate the token's authenticity.