Skip to main content

Request a password reset

POST 
/auth/forgot-password

Request a password reset email. Creates a reset token and sends an email to the user. Always returns success to prevent email enumeration — the response is identical whether or not the address is registered.

An identity with no password set still receives a link, which sets a first password. This covers users migrated from a provider that cannot export password hashes.

The one case where no email is sent (beyond an unknown address) is an identity that has no password but does have another way in — a linked OAuth provider and/or a passkey. Those users are not locked out, so no set-password link is sent; the attempt is recorded as a suppressed message visible via GET /emails.

Request​

Responses​

Password reset requested