Double opt-in & welcome emails

Newsletter signup hygiene boils down to two questions: did the email belong to a real person who asked to be on this list? and did they get an acknowledgement that confirms they're now on it?

FastLinkIt answers both at the contact group level — flip a single toggle and every signup goes through a verified-confirmation flow. Whether or not double opt-in is on, every confirmed signup gets a branded welcome email so the funnel never ends in silence.

Turning on double opt-in

On /contacts/groups, edit the group and tick Require double opt-in in the settings modal. From that moment:

1. New signups via the hosted page, the subscribe widget, or the /api/subscribe REST endpoint create a pending membership row instead of a confirmed one.
2. The signup endpoint sends the visitor a confirmation email with a single-use 32-byte URL-safe token valid for 30 days. The email is branded, mentions the group name, and has one big "Confirm subscription" button.
3. Clicking the button lands on /subscribe/confirm/{token}. The token flips the membership to confirmed and is then cleared (single-use). A second click shows an "already confirmed" message rather than re-running the flow.
4. Drip triggers (group_added) and welcome-sequence enrollment fire after confirmation — pending members never enter the funnel until they verify.

What pending signups look like

Unconfirmed members are kept in the database but excluded from mailings — they appear separately on the group detail page with a "Pending confirmation" badge so you can see your real conversion rate from signup to confirm.

Resending confirmation

A pending row's confirmation token can be regenerated by re-triggering the flow (e.g. the visitor signs up again). The newest token wins and any previously-sent links go dead — protects against leaked or phished older emails.

Token expiry

30 days from generation. After that, the link returns an "expired" message rather than silently confirming — a six-month-old click is more likely a phished URL than a genuine subscriber.

The welcome email

Independent of whether double opt-in is on, every successful signup triggers a transactional "You're subscribed to " email:

• Direct signup (no double opt-in): fires after the membership row is created.
• Double opt-in confirm: fires after the visitor clicks the confirmation link.

Customising the body

The email body uses the group's Thank-you message field (Markdown, set in the group settings modal under "Subscribe page customization"). The same copy that appears on the public thank-you page now also lands in the inbox — one knob, two surfaces.

When the field is empty, a sensible default fires: "You're now subscribed to . We'll be in touch — keep an eye on your inbox."

Markdown supports the standard set: headings, lists, links, bold/italic, blockquotes, fenced code. The email goes through the same Markdig pipeline as the rest of the platform.

Customising the cover image & intro

While you're in the group settings, three other fields shape the public subscribe page itself:

• Cover image URL — rendered above the form on /subscribe/{slug}.
• Intro Markdown — full-width copy block above the form. Useful for explaining what subscribers will receive.
• Show name field — toggle off for a single-input frictionless email-only signup.

Welcome sequence shortcut

Drip campaigns let you send a multi-step series triggered by group_added — the Welcome sequence field on the group settings modal is a one-click shortcut: pick a drip sequence from the dropdown, and confirmed signups (or direct signups when double opt-in is off) are immediately enrolled in it. No need to remember to wire the trigger on the sequence side.

A group can have both the welcome email AND a welcome sequence. They serve different purposes:

• Welcome email — transactional acknowledgement ("you're in"). Fires once. Always.
• Welcome sequence — long-form onboarding with delays between steps. Optional. Configurable per step.

When to use double opt-in

Turn it on when:

• The list is your main marketing asset and you care about long-term deliverability.
• You're sending to recipients in jurisdictions with consent requirements (GDPR, CASL, ePrivacy).
• The signup form lives on a high-traffic public page where bots may submit fake addresses.
• You'd rather have a smaller, confirmed list than a larger, dirty one.

Leave it off when:

• The signup is gated behind authentication (only logged-in users sign up).
• The list is internal-only (employee announcements, customer-only updates).
• You're piping signups from a closed channel (e.g. checkout) where the email is already verified by another step.

Worked example — newsletter with double opt-in & sequence

1. Create a group at /contacts/groups named "Weekly tips". Auto-slug becomes weekly-tips.

2. Open the settings modal. Tick Require double opt-in. Set Thank-you message Markdown:

   Welcome to **Weekly tips**! Every Tuesday at 9 AM you'll get one short, actionable email.
   
   - No filler. No multi-part sales sequences.
   - Just the most useful thing I learned that week.
   
   *— Alex*
   

3. At /mailing/sequences/create build a 3-step welcome series triggered by group_added for this group. Set it as the group's Welcome sequence.

4. Drop the iframe widget on your blog's sidebar:

   <script src="https://flnk.it/js/subscribe-widget.js" data-group="<group-id>"></script>
   

5. A visitor signs up → gets a "Confirm your subscription to Weekly tips" email. Clicks → lands on the confirm page → gets the welcome email (your Markdown rendered) → gets enrolled in the welcome sequence → first sequence step ships at delay-0.

Related

• Newsletter subscribe page & group embed — the public surfaces that drive signups
• Contact Groups — managing groups + members
• Drip campaigns — the multi-step sequences welcome flows enroll into
• Forms — richer signup forms with multiple field types