A simple way to have just one step for users to confirm email address and set initial password using the link you proposed…
Send one email your app generates, including a reset_password_token, and consider user’s possession of that token confirmation of the validity of that email address.
In system account generation code, assuming User model is set up with :recoverable and :database_authenticatable Devise modules…
acct = User.new acct.password = User.reset_password_token #won't actually be used... acct.reset_password_token = User.reset_password_token acct.email = "firstname.lastname@example.org" #assuming users will identify themselves with this field #set other acct fields you may need acct.save
Make the devise reset password view a little clearer for users when setting initial password.
... <%= "true" == params[:initial] ? "Set your password" : "Reset your password" %> ...
Hi <%= @user.name %> An account has been generated for you. Please visit www.oursite.com/users/password/edit?initial=true&reset_password_token=<%= @user.reset_password_token %> to set your password.
No need to include :confirmable Devise module in your User model, since accounts created by your app won’t get accessed without the reset_password_token in the email.
Devise will handle the submit and clear the reset_password_token field.
database_authenticatable.rb for details on
reset_password_token method and friends.
If you want to use Devise
:confirmable module rather than this approach, see the Devise wiki page.