Email verification and password reset

Two flows involve an emailed link: confirming that an address belongs to the person who signed up, and resetting a forgotten password. Your project sends both for you.

How verification works

When someone signs up with a password, they receive a verification email. What happens next depends on your setting Require a verified email before password sign-in (Authentication > Settings > General):

• Required: the sign-up returns no session. The user finishes by opening the emailed link, or typing the emailed token in your app.
• Not required: the user is signed in straight away and the email is a confirmation they can use later.

In the Project Users table, accounts show Verified or Pending. In a user's Manage panel, Mark email verified lets you override this by hand, for example for a customer you have checked yourself.

Where the links point

Emailed links point to your Site URL, followed by a path:

Email	Default link
Verification and magic link	<site url>/auth/confirm?type=magic_link&token=<token>
Password reset	<site url>/auth/reset-password?token=<token>

Your app reads token from the page address and passes it to the matching call. In the TypeScript SDK that is verifyMagicLink({ token }) for verification and magic links, and resetPassword({ token, password }) for a reset.

You can change the path per email in Settings > Emails (see Customize the emails your users receive). You may use {token}, {type} and {email} in the path.

If you leave Site URL empty, the email contains a code or token to type in instead of a link.

Landing on a specific page

Sign-up, magic link, forgot-password and resend-verification calls accept an optional redirect_to. If it is under your Site URL or on your Allowed redirect URLs list, the email links there, with ?token=...&type=... added. Otherwise it is ignored and the default link is used.

Password reset step by step

1. Your sign-in page calls forgotPassword({ email, redirectTo }).
2. The user receives the Password reset email and opens the link.
3. Your reset page reads the token and calls resetPassword({ token, password }) with the new password.

Completing a reset signs the user out everywhere, marks their email verified, and cancels any other reset links.

To start a reset on a user's behalf, open their Manage panel and choose Send password reset email. To set a password directly, use Set a new password, which also signs them out everywhere.

Test it

In Auth Playground, open Password reset. Request a reset for a test account and choose Show it here (no email sent) to see the token without sending anything, then set a new password with it.

Good to know

• Requests for a reset or a verification email are rate limited per address, so a user who presses the button repeatedly will be asked to wait.
• Codes and links are only ever emailed. The API never returns them to the app that asked.