POST
Request a password reset
No sign-in needed For: Everyone Conditions
  • No sign-in is needed; the route allows 5 calls per minute.
  • The email must be a valid address of at most 255 characters; it is lower-cased and trimmed.
  • The call never tells whether an account exists: it answers 200 in both cases.
What else happens
  • When an account exists for the address, creates a password reset token (valid 60 minutes; it replaces any earlier token of the account) and emails a link to the frontend with the token and the email.
  • Nothing is sent when no account exists.
Part of Sign up and sign in.

Authorizations

Authorization
string
header
required

Bearer authentication header of the form Bearer <token>, where <token> is your auth token.

Body

application/json
email
string<email>
required

Email address of the account whose password is reset. It is lower-cased and trimmed. Nothing is sent when no account has this address.

Maximum string length: 255

Response

message
string
required

Confirmation text in the language of the request. Not meant to be parsed. It is the same whether or not an account exists for the address.