Recipient verification

Self-hosted installations default to off: alerts and tests do not require contact confirmation. Set RECIPIENT_VERIFICATION_MODE=enforce on the API and every notification worker to require it; shadow logs eligibility while still delivering. Configure a shared fingerprint secret and public API origin. See the Core guide for setup and limits.

Email recipients explicitly accept or decline an invitation. For WhatsApp, share the visible confirmation link so the recipient sends the prefilled message from their phone. Point Twilio's inbound webhook to POST {PUBLIC_BASE_URL}/webhooks/twilio/whatsapp/inbound. Delivery receipts are not consent. Changing a destination returns its channel to pending.

After a recipient confirms, retry the blocked alert channel. The worker checks current consent before sending and skips destinations that already received the alert.