Signup and verification
What visitors do, confirm, and share after they submit.
This is the visitor-side flow for hosted /w/slug pages, embeds, and server-side Signup API calls. Only published waitlists accept signups.
Visitor steps
Submit an email
The visitor enters a valid email (max 320 characters). If Turnstile is enabled in the form builder, they must also complete its bot check. Hosted and embed forms capture an optional ?r=CODE referral and forward UTM parameters.
Confirm within 24 hours
Waitlyze sends a verification email with a confirmation link. The link expires 24 hours after it is sent. Until confirmed, the subscriber stays in Needs confirmation.
Become verified
Clicking the link sets verifiedAt. Only verified subscribers count toward referral credit, queue position, analytics verification rate, and email eligibility.
Optionally share
If referral sharing is enabled, the confirmation state shows a personal referral link for the subscriber to share.
Verification is not marketing consent
Email confirmation proves ownership. Broadcasts and automations additionally require explicit marketing opt-in, checked again at send time. See Email tools.
How signups arrive
| Channel | Route | Referral passing |
|---|---|---|
| Hosted page | /w/[slug] | ?r=CODE query parameter |
| Embed widget | Your site + /js/embed.js | Forwarded from your page URL |
| Server API | POST /api/waitlist with apiKey, waitlistId, email | If Turnstile is enabled, include the single-use cf-turnstile-response token. Optional referralCode / referral_code is scoped to the same waitlist; response carries the new referral_code + referral_link. GET /api/waitlist re-reads position later. |
Duplicate emails return 409. Non-accepting states (draft, paused) also return 409 with a state reason. Rate-limited clients must respect Retry-After. See Signup API and Troubleshooting.
Impressions and positions
- Each distinct browser view records an impression used for conversion (
signups / visitors). - Queue position uses eligible campaign referrals and signup ordering. It is current campaign state, not a guaranteed reward or access grant.
- Public DTOs are minimal: APIs return rank or position without exposing other subscribers' emails.
Unsubscribe and preferences
Every marketing email includes an unsubscribe link to /unsubscribe/[token]. Unsubscribing stops future broadcasts and automations but keeps the signup record. Resubscription requires a fresh opt-in.