diff --git a/main.go b/main.go
index 5feb79e..9f6d7b8 100644
--- a/main.go
+++ b/main.go
@@ -31,7 +31,7 @@ func main() {
 	users.TokenAuth = auth.TokenAuth
 	blog.TokenAuth = auth.TokenAuth
 
-	// initilize auth
+	// initilize auth for email verification
 	auth.Init()
 
 	// initiate the routes
diff --git a/migrations/1579409382_verification.down.sql b/migrations/1579409382_verification.down.sql
new file mode 100644
index 0000000..42ef445
--- /dev/null
+++ b/migrations/1579409382_verification.down.sql
@@ -0,0 +1,4 @@
+BEGIN;
+ALTER TABLE users
+DROP COLUMN verified IF EXISTS;
+COMMIT;
diff --git a/migrations/1579409382_verification.up.sql b/migrations/1579409382_verification.up.sql
new file mode 100644
index 0000000..ce08762
--- /dev/null
+++ b/migrations/1579409382_verification.up.sql
@@ -0,0 +1,4 @@
+BEGIN;
+ALTER TABLE users
+ADD COLUMN verified boolean NOT NULL DEFAULT false;
+COMMIT;
diff --git a/packages/auth/auth.go b/packages/auth/auth.go
index 8ea5a20..c625e66 100644
--- a/packages/auth/auth.go
+++ b/packages/auth/auth.go
@@ -21,6 +21,7 @@ import (
 var (
 	DB            *sql.DB
 	TokenAuth     *jwtauth.JWTAuth
+	EmailAuth     *jwtauth.JWTAuth
 	PostalEnabled bool
 	PostalKey     string
 	PostalAPI     string
@@ -28,10 +29,13 @@ var (
 
 func Init() {
 	if postal_key, ok := os.LookupEnv("POSTAL_KEY"); ok {
-		PostalKey = postal_key
 		if postal_api, ok := os.LookupEnv("POSTAL_API"); ok {
-			PostalAPI = postal_api
-			PostalEnabled = true
+			if email_auth, ok := os.LookupEnv("EMAIL_SECRET"); ok {
+				EmailAuth = jwtauth.New("HS256", []byte(os.Getenv(email_auth)), nil)
+				PostalKey = postal_key
+				PostalAPI = postal_api
+				PostalEnabled = true
+			}
 		}
 	}
 }
@@ -40,6 +44,10 @@ type ReturnError struct {
 	Message string `json:"error"`
 }
 
+type ReturnSuccess struct {
+	Message string `json:"msg"`
+}
+
 type SignUpCredentials struct {
 	Username string `json:"username", db:"username"`
 	Email    string `json:"email", db:"email"`
@@ -74,6 +82,7 @@ func Routes() *chi.Mux {
 
 func register(w http.ResponseWriter, r *http.Request) {
 	returnError := ReturnError{}
+	returnSuccess := ReturnSuccess{}
 	creds := &SignUpCredentials{}
 	err := json.NewDecoder(r.Body).Decode(creds)
 	if err != nil {
@@ -108,26 +117,38 @@ func register(w http.ResponseWriter, r *http.Request) {
 	}
 
 	hashedPassword, err := bcrypt.GenerateFromPassword([]byte(creds.Password), 10)
-	s := `INSERT INTO users (username, email, password, admin)
-          VALUES ($1, $2, $3, $4)`
-	if _, err = DB.Exec(s, creds.Username, creds.Email, string(hashedPassword), false); err != nil {
+	s := `INSERT INTO users (username, email, password, admin, verified)
+          VALUES ($1, $2, $3, $4, $5)`
+	if _, err = DB.Exec(s, creds.Username, creds.Email, string(hashedPassword), false, false); err != nil {
+		returnError.Message = "unexpected error. please contact the administrator"
 		w.WriteHeader(http.StatusInternalServerError)
+		render.JSON(w, r, returnError)
 		fmt.Println(err)
 		return
 	}
 	users.CreateProfile(creds.Username, creds.Email)
-	w.WriteHeader(http.StatusCreated)
-	expirationTime := time.Now().Add(6 * time.Hour)
+	expirationTime := time.Now().Add(24 * time.Hour)
 	claims := &Claims{
 		Username: creds.Username,
 		StandardClaims: jwt.StandardClaims{
 			ExpiresAt: expirationTime.Unix(),
 		},
 	}
+	if PostalEnabled {
+		_, emailToken, _ := EmailAuth.Encode(claims)
+		fmt.Println(emailToken)
+		w.WriteHeader(http.StatusCreated)
+		//returnSuccess.Message = "User added. Please check your email for a verification link"
+		returnSuccess.Message = emailToken
+		render.JSON(w, r, returnSuccess)
+		return
+	}
 	_, tokenString, _ := TokenAuth.Encode(claims)
-	token := setCookies(w, tokenString, expirationTime)
-	w.WriteHeader(http.StatusOK)
-	render.JSON(w, r, token)
+	setCookies(w, tokenString, expirationTime)
+	w.WriteHeader(http.StatusCreated)
+	returnSuccess.Message = "User created! Welcome to the site!"
+	render.JSON(w, r, returnSuccess)
+	return
 }
 
 func signin(w http.ResponseWriter, r *http.Request) {
@@ -151,7 +172,7 @@ func signin(w http.ResponseWriter, r *http.Request) {
 	if err = bcrypt.CompareHashAndPassword([]byte(storedCreds.Password), []byte(creds.Password)); err != nil {
 		w.WriteHeader(http.StatusUnauthorized)
 	}
-	expirationTime := time.Now().Add(5 * time.Hour)
+	expirationTime := time.Now().Add(24 * time.Hour)
 	claims := &Claims{
 		Username: creds.Username,
 		StandardClaims: jwt.StandardClaims{
diff --git a/settings/website.env-sample b/settings/website.env-sample
index c638859..0f4ab07 100644
--- a/settings/website.env-sample
+++ b/settings/website.env-sample
@@ -1,3 +1,4 @@
 export API_PORT="8080"
+export EMAIL_SECRET="CHANGEMEALSOPLS"
 export JWT_SECRET="CHANGEMEALSO"
 export POSTAL_API="https://POSTAL_URL"