diff --git a/app/Http/Controllers/Api/ApiV1Dot1Controller.php b/app/Http/Controllers/Api/ApiV1Dot1Controller.php
index 053f31fa0..b46fd38cd 100644
--- a/app/Http/Controllers/Api/ApiV1Dot1Controller.php
+++ b/app/Http/Controllers/Api/ApiV1Dot1Controller.php
@@ -547,13 +547,16 @@ class ApiV1Dot1Controller extends Controller
             return response()->json(['error' => 'Invalid tokens'], 403);
         }
 
+        if($verify->created_at->lt(now()->subHours(24))) {
+            $verify->delete();
+            return response()->json(['error' => 'Invalid tokens'], 403);
+        }
+
         $user = User::findOrFail($verify->user_id);
         $user->email_verified_at = now();
         $user->last_active_at = now();
         $user->save();
 
-        $verify->delete();
-
         $token = $user->createToken('Pixelfed');
 
         return response()->json([