Auth: delete unverified accounts automatically
Auth apps can delete accounts whose email was never verified after a number of days you choose, freeing the address for its real owner.
Bots often sign up with other people's email addresses and never verify them. Set unverified_account_ttl_days (1 to 90) on an app, or turn it on under Auth → your app → Settings → Unverified accounts, and a nightly job deletes accounts that never verified their email, never signed in, refreshed a session or reset their password after signing up, and have no two-step factor or social login. Mark people who use your app with end-user metadata app_active: true and they are never deleted.
New apps start at 7 days. Existing apps stay off until you turn it on. Each deletion is in the audit log as auth.account.expired_unverified and sends user.deleted with "reason": "unverified_expired", so your backend can delete its own copy. See webhooks and audit.