← Back to guides

Account recovery without account enumeration

auth.requestPasswordReset creates a single-use link for an existing account and returns successfully for an unknown email address. The application shows the same response in both cases, then sends the token and new password to auth.resetPassword when the link returns.

Return one request response

password-reset.ts
await auth.requestPasswordReset({ email });

return Response.json({
  message: "If that email exists, we sent a reset link.",
});

Consume the token once

reset-password.ts
await auth.resetPassword({
  token,
  newPassword,
});

return Response.json({
  message: "Password updated. Sign in with your new password.",
});

Validate token and newPassword as non-empty strings before the call. auth.resetPassword rejects invalid, expired, and consumed tokens and enforces the configured password policy.

End every existing session

auth.resetPassword consumes the reset token, stores the new password hash, and revokes every session for the account. It does not create a replacement session. Send the user to sign in with the new password.