What causes "You can only verify one address at a time." in phacility/phabricator?

Invoke the workflow once per address: run `bin/auth verify ` separately for each one (e.g. in a shell for-loop).

phacility/phabricator · error · PhutilArgumentUsageException

You can only verify one address at a time.

Error message

You can only verify one address at a time.

What it means

Thrown by `bin/auth verify` when more than one email address is passed on the command line. Because the 'email' argument is declared 'wildcard', the parser collects all trailing arguments into a list; the workflow enforces count($emails) == 1 with this PhutilArgumentUsageException before processing, since verification is defined as a single-address operation.

Source

Thrown at src/applications/auth/management/PhabricatorAuthManagementVerifyWorkflow.php:30

          'Verify an unverified email address which is already attached to '.
          'an account. This will also re-execute event hooks for addresses '.
          'which are already verified.'))
      ->setArguments(
        array(
          array(
            'name' => 'email',
            'wildcard' => true,
          ),
        ));
  }

  public function execute(PhutilArgumentParser $args) {
    $emails = $args->getArg('email');
    if (!$emails) {
      throw new PhutilArgumentUsageException(
        pht('You must specify the email to verify.'));
    } else if (count($emails) > 1) {
      throw new PhutilArgumentUsageException(
        pht('You can only verify one address at a time.'));
    }
    $address = head($emails);

    $email = id(new PhabricatorUserEmail())->loadOneWhere(
      'address = %s',
      $address);
    if (!$email) {
      throw new PhutilArgumentUsageException(
        pht(
          'No email exists with address "%s"!',
          $address));
    }

    $viewer = $this->getViewer();

    $user = id(new PhabricatorPeopleQuery())
      ->setViewer($viewer)

View on GitHub (pinned to 5720a38cfe)

Solutions

Invoke the workflow once per address: run `bin/auth verify <address>` separately for each one (e.g. in a shell for-loop).
Quote variables and check the argument count in wrapper scripts before calling the command.
If the addresses came from a file, loop over its lines: `while read -r a; do bin/auth verify "$a"; done < list.txt`.

Example fix

// before
$ bin/auth verify alice@example.com bob@example.com
You can only verify one address at a time.

// after
$ for a in alice@example.com bob@example.com; do bin/auth verify "$a"; done

Defensive patterns

Strategy: validation

Validate before calling

// PHP wrapper: enforce the one-address rule before shelling out
if (count($addresses) !== 1) {
  throw new Exception('Pass exactly one address per invocation.');
}
// shell: always quote
// bin/auth verify "{$addresses[0]}"

Prevention

Loop over addresses, one command invocation per address.
Quote every interpolated argument in shell scripts to prevent word-splitting.
Beware unquoted variables and shell globs expanding into multiple arguments.

When it happens

Trigger: Running `bin/auth verify alice@example.com bob@example.com`; a shell glob (e.g. `bin/auth verify *.txt`) or unquoted variable expanding into multiple words; pasting a comma- or space-separated list of addresses.

Common situations: An admin tries to bulk-verify a mailing list of addresses in one invocation; a script passes an unquoted `$EMAILS` variable containing several addresses; quoting is lost when the command is copy-pasted through a ticket system.

Related errors

AI-assisted analysis of phacility/phabricator@5720a38cfe (2026-08-21). Data as JSON: /api/errors/61bafa2b794c0a53. Report an issue: GitHub.