Pre-1.0 · one maintainer · Stripe and cards only · no SDKs (client libraries) yet · no production users yet. Docs describe v0.9.1 (29 Oct 2026) · What’s new →

Check a password reset token

GET

/v1/auth/password-reset/check

const url = 'http://localhost:8080/v1/auth/password-reset/check?token=example';
const options = {method: 'GET'};

try {
  const response = await fetch(url, options);
  const data = await response.json();
  console.log(data);
} catch (error) {
  console.error(error);
}

curl --request GET \
  --url 'http://localhost:8080/v1/auth/password-reset/check?token=example'

Tells whether a reset token can still be used, without using it up. The reset-password page calls it on load, so it can show “this link is no longer valid” before the user types a new password. An unknown, expired or already-used token returns 422 with code invalid_or_expired.

Parameters

Query Parameters

token

required

string

The token from the reset link.

Responses

200

Token can be used

application/json

object

valid

required

boolean

Example

{
  "valid": true
}

422

invalid_or_expired (param token): the token is unknown, expired or already used

application/json

object

error

object

type

One of invalid_request_error, authentication_error, rate_limit_error or api_error. Every error the API answers has this shape, including an unknown path (404, code route_not_found) and a method the path does not take (405, code method_not_allowed, with an Allow header). The few exceptions are listed in docs/api-surface.md.

string

code

string

message

string

request_id

string

param

The request field the error is about. Sent only when the error names one. A request body may hold only the fields its operation lists, spelled and cased as listed: any other field, or one the server sets (such as id), is refused with 422 and param naming it. An operation with no request body lists no fields: send no body, {} or null. The Stripe and Postmark webhooks and the LiteLLM callback take their sender’s body as it comes.

string

Example

{
  "error": {
    "type": "invalid_request_error"
  }
}

429

Rate limited (shared per-IP limit on /v1/auth)

application/json

object

error

object

type

string

code

string

message

string

request_id

string

param

string

Example

{
  "error": {
    "type": "invalid_request_error"
  }
}