Feature Request: Email confirmation (double opt-in) for free ticket registrations

[LuhiFox]

For free events, anyone can complete checkout instantly and receives a ticket right away. There is no verification that the email address actually belongs to the person registering. This leads to several problems:

• Duplicate registrations: The same person can register multiple times (with the same or different emails), taking up limited capacity.
• Fake or mistyped emails: Tickets are issued to invalid addresses, and the spots are lost for real attendees.
• No-shows: Because registering costs nothing, people sign up "just in case", which makes capacity planning difficult.

"Maximum tickets per order" helps a bit, but it doesn't prevent someone from simply placing multiple orders.

An optional per-event (or per-product) setting, e.g. "Require email confirmation for free orders", with the following behavior:

1. After checkout, the order is placed in a new status such as AWAITING_EMAIL_CONFIRMATION (similar to the existing "Awaiting offline payment" status).
2. The buyer receives a confirmation email with a unique, time-limited link.
3. Only after clicking the link is the order marked as COMPLETED and the ticket email (with QR code) sent.
4. Unconfirmed orders expire automatically after a configurable time (e.g. 24 hours), and the capacity is released back (and offered to the waitlist, if enabled).
5. Unconfirmed tickets cannot be checked in.

Optional but very useful addition:

• A setting "Allow only one registration per email address per event", which blocks checkout (or shows a clear message) if the email already has an active or pending order for that event.

• Using webhooks and an external service to send a confirmation email and cancel unconfirmed orders via the API. This works, but the ticket email is still sent immediately, and it requires running and maintaining extra infrastructure.

• Modifying the core code in a self-hosted instance, which makes updating to new releases difficult.

This is especially relevant for community events, meetups, and free workshops with limited capacity. Many other registration platforms offer double opt-in for exactly this reason. It would also help with GDPR compliance, since it verifies that the person registering actually owns the email address.

We self-host Hi.Events and would be happy to help test this feature.