I did it this way:
1. registration window: email and password.
2.When he presses the register button he checks if the email is busy and if, for example, the password meets security standards.
3. generates a token (e.g. 8 characters) and writes it to the user table. Then I send an email template from B4X containing a link with an embedded token.
https://mysite/portal/register?token=generate_token and adds info that he can go to
https://mysite/portal/register and enter the token manually.
4. when he clicks on the link an ABMaterial page opens which checks the parameters of the link, if there is a token variable it triggers a check if there is a token for any user in the database. If there is, it indicates that the account is confirmed and the token is deleted. If there is no token it builds a page that there is no such token to verify.
5. if the link itself and there is no parameter, it opens the page with a field to write a token for registration and button confirm.
The same is done for password reminders, etc.