@@ -5052,7 +5052,7 @@
         contentType: ContentType::JSON,
     ))
     ->label('abuse-limit', 10)
-    ->label('abuse-key', 'userId:{userId},ip:{ip}')
+    ->label('abuse-key', 'url:{url},userId:{userId}')
     ->param('phrase', false, new Boolean(), 'Toggle for security phrase. If enabled, email will be sent with a randomly generated phrase and the phrase will also be included in the response. Confirming phrases match increases the security of your authentication flow.', true)
     ->inject('request')
     ->inject('response')
@@ -5089,7 +5089,7 @@
             '$id' => ID::unique(),
             'userId' => $user->getId(),
             'userInternalId' => $user->getSequence(),
-            'type' => TOKEN_TYPE_VERIFICATION,
+            'type' => TOKEN_TYPE_VERIFICATION_OTP,
             'secret' => $proofForCode->hash($secret),
             'expire' => $expire,
             'userAgent' => $request->getUserAgent('UNKNOWN'),
@@ -5236,7 +5236,7 @@
             recipient: $user->getAttribute('email'),
             name: $user->getAttribute('name') ?? '',
             subject: $subject,
-            template: MAIL_TEMPLATE_OTP,
+            template: MAIL_TEMPLATE_OTP_VERIFICATION,
             bodyTemplate: $bodyTemplate,
             body: $body,
             preview: $preview,
@@ -5284,7 +5284,7 @@
         contentType: ContentType::JSON,
     ))
     ->label('abuse-limit', 10)
-    ->label('abuse-key', 'userId:{param-userId}')
+    ->label('abuse-key', 'url:{url},userId:{param-userId}')
     ->param('userId', '', fn (Database $dbForProject) => new UID($dbForProject->getAdapter()->getMaxUIDLength()), 'User ID.', false, ['dbForProject'])
     ->param('secret', '', new Text(256), 'Valid verification OTP code.')
     ->inject('response')
@@ -5301,7 +5301,7 @@
             throw new Exception(Exception::USER_NOT_FOUND);
         }
 
-        $verifiedToken = $profile->tokenVerify(TOKEN_TYPE_VERIFICATION, $secret, $proofForCode);
+        $verifiedToken = $profile->tokenVerify(TOKEN_TYPE_VERIFICATION_OTP, $secret, $proofForCode);
 
         if (!$verifiedToken) {
             throw new Exception(Exception::USER_INVALID_TOKEN);
@@ -5325,4 +5325,3 @@
 
         $response->dynamic($verificationDocument, Response::MODEL_TOKEN);
     });
-
@@ -204,6 +204,7 @@
 const TOKEN_TYPE_OAUTH2 = 7;
 const TOKEN_TYPE_GENERIC = 8;
 const TOKEN_TYPE_EMAIL = 9; // OTP
+const TOKEN_TYPE_VERIFICATION_OTP = 10;
 
 /**
  * Session Providers.
@@ -347,6 +348,7 @@
 const MAIL_TEMPLATE_MAGIC_URL = 'magic-url';
 const MAIL_TEMPLATE_MFA_CHALLENGE = 'mfa-challenge';
 const MAIL_TEMPLATE_OTP = 'otp';
+const MAIL_TEMPLATE_OTP_VERIFICATION = 'otp-verification';
 const MAIL_TEMPLATE_RECOVERY = 'recovery';
 const MAIL_TEMPLATE_SESSION_ALERT = 'session-alert';
 const MAIL_TEMPLATE_SMTP_TEST = 'smtp-test';
 
@@ -0,0 +1,3 @@
+Use this endpoint to send a 6-digit verification code to the currently logged in user's email address. Unlike [createEmailVerification](https://appwrite.io/docs/references/cloud/client-web/account#createEmailVerification), this method requires no redirect URL, which makes it suitable for mobile and desktop apps that cannot host a verification page. Learn more about how to [complete the verification process](https://appwrite.io/docs/references/cloud/client-web/account#updateEmailVerificationOTP). The code sent to the user's email address is valid for 15 minutes.
+
+Enable the **phrase** parameter to include a randomly generated security phrase in both the email and the response. Showing that phrase in your app lets the user confirm the email genuinely came from your request, which helps protect against phishing.
@@ -0,0 +1 @@
+Use this endpoint to complete the user email verification process using the 6-digit code that was emailed by [createEmailVerificationOTP](https://appwrite.io/docs/references/cloud/client-web/account#createEmailVerificationOTP). Pass the **userId** of the user being verified along with the **secret** code from the email. If confirmed, this route will return a 200 status code and the code is consumed.
@@ -1232,6 +1232,7 @@ private function deleteExpiredTokens(Document $project, callable $getProjectDB):
             TOKEN_TYPE_OAUTH2,
             TOKEN_TYPE_GENERIC,
             TOKEN_TYPE_EMAIL,
+            TOKEN_TYPE_VERIFICATION_OTP,
         ];
 
         // Current index is on {`type`, `expire`}
 
@@ -6140,7 +6140,6 @@ public function testCreateEmailVerificationOTP(): void
         $data = $this->setupAccountWithSession();
         $session = $data['session'];
         $email = $data['email'];
-        $name = $data['name'];
 
         /**
          * Test for SUCCESS
@@ -6300,6 +6299,35 @@ public function testUpdateEmailVerificationOTP(): void
         ]);
 
         $this->assertEquals(404, $response['headers']['status-code']);
+
+        /**
+         * Test for FAILURE - OTP is single use
+         */
+        $response = $this->client->call(Client::METHOD_PUT, '/account/verifications/email/otp', array_merge([
+            'origin' => 'http://localhost',
+            'content-type' => 'application/json',
+            'x-appwrite-project' => $projectId,
+            'cookie' => 'a_session_' . $projectId . '=' . $session,
+        ]), [
+            'userId' => $userId,
+            'secret' => $otp,
+        ]);
+
+        $this->assertEquals(401, $response['headers']['status-code']);
+        $this->assertEquals('user_invalid_token', $response['body']['type']);
+
+        /**
+         * Test for FAILURE - email already verified
+         */
+        $response = $this->client->call(Client::METHOD_POST, '/account/verifications/email/otp', array_merge([
+            'origin' => 'http://localhost',
+            'content-type' => 'application/json',
+            'x-appwrite-project' => $projectId,
+            'cookie' => 'a_session_' . $projectId . '=' . $session,
+        ]));
+
+        $this->assertEquals(409, $response['headers']['status-code']);
+        $this->assertEquals('user_email_already_verified', $response['body']['type']);
     }
 
     public function testCreateIdTokenSessionGoogleShapedClaims(): void
 
@@ -43,6 +43,7 @@ public function testGetEmailTemplateAllSupportedTypes(): void
             'mfaChallenge',
             'sessionAlert',
             'otpSession',
+            'otpVerification',
         ];
 
         foreach ($types as $type) {
@@ -1282,6 +1283,7 @@ public function testGetConsoleEmailTemplateAllTypes(): void
             'mfaChallenge',
             'sessionAlert',
             'otpSession',
+            'otpVerification',
         ];
 
         foreach ($types as $type) {
Original file line number	Diff line number	Diff line change
`@@ -0,0 +1,3 @@`
	`1`	+Use this endpoint to send a 6-digit verification code to the currently logged in user's email address. Unlike [createEmailVerification](https://appwrite.io/docs/references/cloud/client-web/account#createEmailVerification), this method requires no redirect URL, which makes it suitable for mobile and desktop apps that cannot host a verification page. Learn more about how to [complete the verification process](https://appwrite.io/docs/references/cloud/client-web/account#updateEmailVerificationOTP). The code sent to the user's email address is valid for 15 minutes.
	`2`	`+`
	`3`	`+Enable the phrase parameter to include a randomly generated security phrase in both the email and the response. Showing that phrase in your app lets the user confirm the email genuinely came from your request, which helps protect against phishing.`
Original file line number	Diff line number	Diff line change
`@@ -0,0 +1 @@`
	`1`	`+Use this endpoint to complete the user email verification process using the 6-digit code that was emailed by [createEmailVerificationOTP](https://appwrite.io/docs/references/cloud/client-web/account#createEmailVerificationOTP). Pass the userId of the user being verified along with the secret code from the email. If confirmed, this route will return a 200 status code and the code is consumed.`