I'm developing an application based on microservices architecture. Currently my goal is to implement 'Create user' flow. But I'm not sure quite sure what is the right way to do it.

My problem is as follows:

I want to have two microservices - Account and Auth. Account would be responsible for account related data such as - name, surname, addresses, email etc. Auth would be responsible for storing usernames/passwords/roles and for generating tokens.

It seems that Account service should only store only information related to accounts and hence should not store passwords and roles because this is something related to Auth service. However, when someone creates a user, I want to send 'activate account link' to the specified email related to account being created. This means that I should store account and password/roles related data somewhere and mark this data as 'not active' until activation link is followed. And for me the hard question is - how and where should I store it.

Currently I have the following ideas:

  1. When account for the user is being created, Account microservice receives all account related data + password/roles and saves it somewhere with a mark that account and user are 'not active' yet + sends activation link. Then, when user follows the link, account microservice marks account data as 'active', deletes roles and password and makes a request to Auth service to save roles/password related to this account. I don't like this approach as long as it seems to me that account service should not know and should not store roles and passwords.

  2. When account for the user is being created, Account microservice receives all account related data + username/password/roles. It saves account related data and marks it as 'not active' + sends request to Auth service to save corresponding username/password/roles, Auth saves this data and also marks it as 'not active' + Account microservice sends activation link to the email. Hence Account microservice does not store any passwords and roles Then, when user follows activation link, account microservice marks account data as 'active' and makes a request to Auth service which also marks corresponding username/password/roles as 'active'. This approach seems to be a better way of implementation.

I'm pretty sure that I miss some other options which are better solutions to the problem.

Could someone, who has similar experience, please give an advice on this?

Would really appreciate any help with regards to this,


  • most auth packages will have a 'deactivated' and 'verified' flags against the users. when the account is setup create the auth user and mark it unverified. when the verification link is clicked have the auth service mark the account verified – Ewan Mar 16 '18 at 14:43

Your Answer

By clicking "Post Your Answer", you acknowledge that you have read our updated terms of service, privacy policy and cookie policy, and that your continued use of the website is subject to these policies.

Browse other questions tagged or ask your own question.