Forgot password
Auth
Forgot password
Start a password reset. Sends a 6-digit code if the email is known and verified.
POST
Forgot password
Overview
Initiates a password reset by sending a 6-digit code to the supplied email. The code has a 15-minute TTL (longer than the email-verify OTP because mobile users often switch apps to read it). The endpoint always returns200 OK. The actual side effect — whether an email is sent — depends on internal state the response does not reveal:
- Email unknown → silent no-op.
- Email known but unverified → silent no-op. (Prevents using password-reset as a verification bypass.)
- Email belongs to an OAuth-only account (Google / Apple, no password set) → silent no-op.
- Email known, verified, has a password → fresh 6-digit code dispatched via Resend.
Authentication
None required.Path parameters
None.Query parameters
None.Request body
| Field | Type | Required | Allowed values | Example |
|---|---|---|---|---|
email | string | yes | RFC 5322 valid, lowercased server-side | alice@example.com |
Example payload
Response — 200 OK
| Field | Type | Notes | Example |
|---|---|---|---|
ok | boolean | Always true. | true |
Example response
Error responses
| Status | Code | Meaning |
|---|---|---|
| 400 | VALIDATION_FAILED | Email malformed. |
404, no 409, no rate-limit response from this endpoint. The internal cooldown is silent so the response shape stays constant.
Side effects
When the email belongs to a verified, password-using, non-deleted account:- Inserts an
otp_codesrow (purpose: 'password_reset', 15-min TTL). Any prior outstanding reset code for this email is invalidated. - Sends an email via Resend with the 6-digit code.
See also
- Reset password — confirm the code and set a new password.