Skip to main content

Request a password reset code by email

POST 
/api/v1/auth/reset-password

Always returns 201 regardless of whether the email exists (enumeration-safe). If a matching local-provider user exists, a 6-character code is emailed and a password-reset challenge is created (5 min expiry, 3 attempts). Rate-limited per email (3 requests per 1-hour window).

Request​

Responses​

Request accepted (no body)