OAuth links can be forwarded. Forwarded links can be clicked by the wrong person. When that happens, the connected account activates under the wrong identity, and your agent acts as someone it shouldn't.

User verification closes that gap.

Before an agent is allowed to act on someone's behalf, it requires a two-point identity match: the OAuth consent, plus confirmation that the person who clicked is the same person your app already has a session for. Even if an attacker completes OAuth on a forwarded link, the verify call fails. Identity comes from your session — not from anything in the URL.

It's one additional call in your authorization flow. The connected account only becomes ACTIVE when both signals match.

‍