Pre-1.0 · one maintainer · Stripe and cards only · no SDKs (client libraries) yet · no production users yet. Docs describe v0.9.1 (29 Oct 2026) · What’s new →
Request a password reset link
POST
/v1/auth/password-reset/request
const url = 'http://localhost:8080/v1/auth/password-reset/request';const options = { method: 'POST', headers: {'Content-Type': 'application/json'}, body: '{"email":"hello@example.com"}'};
try { const response = await fetch(url, options); const data = await response.json(); console.log(data);} catch (error) { console.error(error);}curl --request POST \ --url http://localhost:8080/v1/auth/password-reset/request \ --header 'Content-Type: application/json' \ --data '{ "email": "hello@example.com" }'Always returns the same 200 body regardless of whether the email
exists, to avoid account enumeration. If a user matches, a
single-use 1-hour token is generated and the reset link is
emailed via SMTP (requires SMTP_HOST and DASHBOARD_BASE_URL;
there is no stdout fallback). email_delivery reports whether
this deployment can deliver reset emails at all — deployment
posture, computed independently of any match, so it leaks no
account existence.
Request Bodyrequired
Section titled “Request Bodyrequired”Media typeapplication/json
object
email
required
string format: email
Example generated
{ "email": "hello@example.com"}Responses
Section titled “Responses”Request accepted (identical body regardless of email existence)
Media typeapplication/json
object
message
required
string
email_delivery
required
Whether this deployment can deliver reset emails
(SMTP configured AND DASHBOARD_BASE_URL set).
Deployment posture, never account state.
string
Example
{ "email_delivery": "ok"}