Link lasts 60 minutes

The emailed link expires after one hour. Ask again if it timed out.

RESET_TTL_MS is 60 minutes. After that, /reset rejects the code and the buyer requests a new link.

The server stores a sha256 digest. Plaintext never stays in the database.