Password reset
How Cloud Control's enumeration-safe password reset works: request a link, receive a single-use token, set a new password, and have all existing sessions revoked.
Password reset in Cloud Control is a standard emailed-link flow, written to be enumeration-safe and to fail closed.
Request a reset
Submit an email to `POST /api/auth/forgot`. The response is identical whether or not the email is registered — a 200 { ok: true } — so it never reveals which addresses have accounts. If the address exists, a single-use reset link is generated and delivered.
Any mail provider can subscribe by setting RESET_EMAIL_WEBHOOK_URL (a POST of { to, resetUrl }). Without it — the documented development behavior — the link is written to the server log only, never returned in a response.
Set a new password
The reset page (/reset?token=…) posts the token and a new password to `POST /api/auth/reset`. The password is validated (at least 8 characters) before the token is consumed, so a typo does not burn a single-use link. Every token failure — unknown, expired or already used — returns the same generic 400.
Sessions are revoked
A successful reset proves control of the email, not of any session, so all of the user's existing sessions are revoked. There is no auto-login; the user signs in with the new password, and MFA still applies if enabled. Resets are audited as auth.reset_requested and auth.password_reset.
Reset links stay open
The /forgot and /reset pages are reachable even with a stale session cookie, so a user on a compromised or shared device can always complete an emailed reset rather than being redirected away.