Double opt-in in Brevo: confirm before you send

A shopper submits a newsletter form and closes the tab. Their email address may be stored, but the subscription is unfinished. If a campaign goes out now, the confirmation step has done no work.

Double opt-in asks the person to click a link in a confirmation email before marketing starts. The click helps establish that someone with access to the inbox completed the signup. It does not prove that a human filled in the form, guarantee inbox placement, or settle every consent question.

Keep three states separate

Can this address receive a marketing campaign?

1. Pending: signup submitted, no confirmation click

   No. Send only the requested confirmation message.

   An address in a temporary list or an application database is still waiting for confirmation.

2. Confirmed: clicked and currently subscribed

   Yes, for the marketing purpose disclosed at signup.

   Check both the confirmation and the current channel subscription status.

3. Unsubscribed or blocklisted

   No. Preserve the opt-out.

   A past click must not override a later unsubscribe.

The distinction matters because Brevo separates confirmation history from current marketing status. Its DOUBLE_OPT-IN attribute records whether someone confirmed through a Brevo form; it does not by itself control whether that contact is subscribed today. A purchase record, an imported contact, or an email address in a CRM is also not a newsletter subscription.

Use a Brevo sign-up form when you can

Brevo’s form setup is the shortest route for a simple newsletter signup:

1. Go to Marketing > Forms, create a sign-up form, and add an email field. Write down what emails the person is agreeing to receive next to the signup control.
2. Choose the destination list. In Settings, select Double confirmation email and choose Brevo’s default DOI template or a custom DOI template with its required confirmation link.
3. Set the page shown after form submission to say check your inbox. If you add a page shown after the confirmation click, make that page say the subscription is complete. These are different moments.
4. Save the form and share its hosted URL or embed it. Preview its mobile layout and check that the confirmation message names your sender and the requested subscription.

With Brevo’s double-confirmation form, the person joins the selected contact list only after clicking the email link. Brevo also offers CAPTCHA on the form. Use it if form abuse is a problem; confirmation alone does not make automated submissions impossible. A single-confirmation form behaves differently: it adds the contact when the form is submitted, even though it sends a follow-up email.

If the signup starts in your own form

Brevo documents two paths. Its dedicated DOI API endpoint is POST /v3/contacts/doubleOptinConfirmation. Send the email address, includeListIds, templateId, and redirectionUrl from your server. The DOI template uses {{ params.DOIurl }} for the confirmation link. Keep the API key on the server. A regular contact-creation request is a different operation; creating a contact first does not make it confirmed.

The alternative is Brevo’s external-form automation. Add submissions to a temporary list that receives no campaigns. The automation sends a confirmation email, waits for the click, then adds confirmed contacts to a final list and removes them from the temporary one. Brevo recommends blocklisting contacts who do not confirm within the configured wait. Choose one confirmation path per signup so people do not receive duplicate requests.

Keep your own pending record if you need to reconcile form submissions with Brevo. Store the signup source, the wording shown at signup, and the event time. Do not turn a webhook retry into another confirmation send. Use a stable submission identifier where one exists, rate-limit public forms and resend requests, and check the latest subscription state before any promotion. Those are implementation controls to test in your system, not a promise that Brevo performs them for you.

Test the boundary before publishing the form

Use an address you control and inspect the destination list or contact detail after each step:

• Submit, then stop: The page asks the visitor to check their inbox. No marketing campaign audience includes this pending address. For a Brevo form, check that it has not joined the selected list; for the temporary-list automation, check that it has not joined the final list.
• Click once: The confirmation page says the subscription is complete. The contact appears in the expected final list, and its current marketing status permits the intended email.
• Unsubscribe: A later opt-out removes marketing eligibility. Replay an old signup event or click an old link in a safe test account; neither should silently undo that opt-out.
• Request again: Repeated submissions or resend requests do not flood the inbox or create duplicate welcome messages. Test an existing unsubscribed address separately from a new one.

If confirmation fails, inspect the actual form configuration, template link, automation branch, and current blocklist state. Avoid guessing from a generic success screen: it may only mean that the form was submitted.

“Can’t we send the welcome email first?” A welcome campaign is marketing if it promotes the subscription’s promised content or offers. Make its trigger the confirmed, currently subscribed state. Transactional order messages follow their own purpose and should not be used to slip in newsletter content.

For a custom website form, see the Webflow to Brevo guide. For store customer records and marketing status, see the Shopify to Brevo guide. A stored address is easy to copy. Permission has to survive the copy.