Talent: verify a work email

From your Talent profile, save any edits and choose Verify work email. Enter your company address, then the six-digit code from the email. Public email providers are rejected. The code expires in ten minutes, permits five attempts, and can be requested at most once per minute and five times per hour per person and destination address. A new code replaces the previous one; limits survive Hub restarts.

Verification confirms mailbox access, not employment. Your verified domain is owner-only and stays in your blocked employer domains even if you clear the editable list. Companies see only “Work email verified.” Your login address and workspace memberships do not change. The full address is stored only in the private verification challenge, not in the profile summary.

The owner-only POST /me/profile/work-email accepts {email}; POST /me/profile/work-email/confirm accepts {code}. Both require a human session and TALENT_ENABLED=1. Code hashes are salted, attempts are persisted, and profile verification and code consumption commit together. Delivery reuses GMAIL_USER and GMAIL_APP_PASSWORD; missing configuration reports unavailable, and a failed delivery still consumes the send quota to prevent retry spam.