Guide: double opt-in

Collect a pending email preference, send a confirmation link, and only write GRANTED once the person clicks.

Some regulations (ePrivacy, certain GDPR interpretations) require confirmed opt-in for marketing emails: record the intent, send a verification email, and only activate the subscription when the link is clicked. This guide covers the full flow.

Before you start

• Create a preference-center purpose with category marketing (e.g. key newsletter).
• Create a sk_ key for your server.
• Have a transactional email service ready — you send the email; Tripticonsent provides the token.

1. User submits a signup form

On your server, write a pending preference record and request a short-lived confirmation token.

// server — sk_ key
const { token, expiresAt } = await tc.createPreferenceConfirmationToken({
  subject: 'email:' + user.email,
  channel: 'marketing',
  topic: 'newsletter',
  redirectUrl: 'https://acme.com/subscription/confirmed',
});

2. Send the confirmation email

Build the link yourself and send it via your email provider. The confirmation endpoint is public — no key needed.

const confirmUrl = `https://api.tripticonsent.com/v1/preferences/confirm?token=${token}`;

await mailer.send({
  to: user.email,
  subject: 'Please confirm your subscription',
  html: `<a href="${confirmUrl}">Yes, subscribe me</a>`,
});

3. The user clicks

Tripticonsent writes GRANTED to the vault, fires a preference.confirmed webhook, then redirects the user to your redirectUrl. Nothing else to do on your end.