Answering my own question: We were copying the payload we received from Kratos to the webhook.. Verification works if we return a verifiable address without

created_at

and

id

, and set

via

to email