Guide · Agent skill
How to use the Verified Email for Android agent skill
Updated · written with AI from the project's own documentation and checked against our catalogue data
The verified-email skill is a step-by-step guide that an AI coding agent follows to add a sign-up, account recovery, or re-authentication flow to an Android app. Instead of sending a one-time code or magic link, the app asks the user's device for a cryptographically signed email credential from a trusted provider such as Google. This page explains what the skill does, how to install it, how to trigger it with plain requests, and what you still need to build yourself.
Verified Email for Androidandroid/skills · Apache-2.0 Download the skill Quick start
- 1Download and unzip the skill. Download the verified-email ZIP from this page and unzip it into ~/.claude/skills/ or a project's .claude/skills/ folder.
- 2Confirm project requirements. Check that your app uses Credential Manager 1.7.0-alpha03, minimum SDK 28, and Google Play services 25.49.x or higher.
- 3Set up your backend validation. Make sure your server can validate SD-JWT credentials, because the skill does not implement this.
- 4Ask for the flow in plain language. Describe the sign-up, recovery or re-authentication flow you want and name your Android app.
- 5Let the agent locate the screens. The agent searches your codebase for routes, view-models and sensitive actions that match the flow.
- 6Review the generated code and TODOs. Check the request JSON, the response parsing and every TODO for server-side validation.
What the verified-email skill makes the agent do
Agent skills are folders of instructions and reference files that an AI agent loads when a task matches them. The verified-email skill covers one job: integrating verified email retrieval into an Android app using Android's Credential Manager API and the OpenID4VP digital credentials standard.
The agent can locate likely screens and view-models in your codebase, such as sign-up screens, recovery flows and delete-account screens. It then builds a Digital Credential request, parses the response, and leaves TODOs for server-side checks.
- Finds sign-up, recovery and reauthentication code using search keywords such as SignUpScreen, "Recover Account" and DeleteAccount.
- Builds a GetCredentialRequest containing a GetDigitalCredentialOption with an OpenID4VP request.
- Parses the returned SD-JWT response into a VerifiedUserInfo data class with the name and email.
- Offers a passkey creation option if one is not already present.
- Leaves a TODO where your backend must validate the credential.
Install the verified-email skill
Download the ZIP for this skill from our page and unzip it into one of two locations. Use ~/.claude/skills/ to make the skill available across your projects, or use a project's .claude/skills/ folder to limit it to one codebase.
If you use the Claude apps instead, upload the skill under Settings → Capabilities → Skills.
- Personal install: unzip into ~/.claude/skills/
- Project install: unzip into .claude/skills/ inside your project
- Claude apps: Settings → Capabilities → Skills, then upload the skill
Check your project requirements before you start
The skill targets a specific setup. Confirm your project matches it before asking the agent to make changes, because the skill will not fix a mismatched environment for you.
- An Android project that uses Credential Manager at androidx.credentials 1.7.0-alpha03.
- Google Play services version 25.49.x or higher.
- Android minimum SDK 28 (Android 9).
- A backend that validates SD-JWT credentials. The skill does not provide this.
implementation("androidx.credentials:credentials:1.7.0-alpha03")
implementation("androidx.credentials:credentials-play-services-auth:1.7.0-alpha03")Trigger the skill with natural requests
You do not need special syntax. Describe the outcome you want in plain language and mention Android and the flow you need. Be specific about which screen or action is involved, since the skill uses those cases to choose its search strategy.
Good requests name the flow and the app: sign-up without OTP, account recovery, or re-authentication before deleting an account.
- "Add OTP-less sign-up to my Android app using a verified email from Google."
- "Find the account recovery screens in this codebase and add verified email retrieval."
- "Add a re-authentication step with a verified email before the delete account action."
Review the code the agent produces
The skill is client-side only. It states that your backend must validate the returned credential, and it does not implement that validation. Treat the TODO comments as required work, not optional notes.
Check the request JSON against the documentation the skill references, and confirm the response is handled as a DigitalCredential with credential.credentialJson read as the response JSON string. The skill also suggests showing a snackbar with user details for reference only and directing users to the home screen after success.
- Verify your backend validates the SD-JWT before trusting the email.
- Do not treat the displayed email as proof on its own in server logic.
- Confirm your minimum SDK and Play services versions match the requirements.
Where this skill fits and where it does not
The skill is a good fit for Android developers adding OTP-less sign-up or recovery to an existing app, especially where the backend can already verify SD-JWT credentials. It is also useful for re-authentication before sensitive actions.
It is not a fit for apps that must support Google Workspace accounts, because Google does not issue verifiable credentials for them. It is also not suitable for non-Android platforms or for apps below minimum SDK 28.
- Google Workspace accounts are not supported.
- Non-gmail.com addresses carry no freshness claim, so the skill recommends an extra OTP challenge.
- Non-Android platforms and minimum SDK below 28 are not covered.
What people use it for
- Replacing an email OTP step in a new-account sign-up screen with a verified email credential.
- Adding a recovery path that proves email ownership without sending a code.
- Requiring a fresh re-authentication step before deleting an account or changing payment details.
- Storing a parsed name and email in a VerifiedUserInfo object for a profile screen.
Frequently asked questions
How do I install the verified-email skill?
Download the ZIP from this page and unzip it into ~/.claude/skills/ for personal use, or into a project's .claude/skills/ folder. In the Claude apps, you can upload it under Settings → Capabilities → Skills.
Is the verified-email skill free?
The skill is listed under the Apache-2.0 licence. The source says complete terms are in LICENSE.txt, so check that file for the full terms before you use or redistribute it.
What do I need to use the verified-email skill?
You need an Android project using Credential Manager 1.7.0-alpha03, Google Play services 25.49.x or higher, and minimum SDK 28. You also need a backend that validates SD-JWT credentials, since the skill does not provide one.
Does verified email work with Google Workspace accounts?
No. The skill notes that Google does not issue verifiable credentials for Google Workspace accounts, so this approach will not cover those users.
Does the skill need to be fed a fresh email for every user?
No, but the email may not be fresh. For non-gmail.com addresses, the skill says there is no freshness claim, and it recommends adding an extra challenge such as an OTP.
Does the skill run scripts or use the network?
According to the listing, it does not run scripts and does not use the network. It is a client-side guide for code changes, and the server-side validation must be built separately in your backend.
New agent skills, repos and AI tools — every week
The best new skills and open-source projects, the fastest-growing repos, and one free prompt. Five minutes to read. Unsubscribe anytime.
Our verdict
Use this skill if you are an Android developer who wants to add OTP-less sign-up, account recovery or re-authentication to an app whose backend can already validate SD-JWT credentials. Pick another approach if your users need Google Workspace accounts, your app targets non-Android platforms or minimum SDK below 28, or you cannot build server-side validation.
Download the skill