Forgot password

Same reply if the email is unknown

Unknown addresses get the same generic copy. Kumir does not 404.

Link lasts 60 minutes

The emailed link expires after one hour. Ask again if it timed out.

Too many requests stay generic

After three asks in an hour the API still returns the same copy.

Enter the code at /reset

After the email, web opens /reset. Native stays on the splash reset step.

Redirects stay on Kumir

redirectFromSearch only allows same-origin paths. Default return is /login.

Not Log in

Already remember your password? /login. This page only starts a reset.

Not Sign up

New buyers use /signup. Forgot does not mint a User.

Not Verify email

Confirming a new account is /verify. Forgot does not send a verify code.

No invented Resend key

EMAIL_PROVIDER=resend only when RESEND_API_KEY is set. Otherwise Kumir logs.

/forgot is reserved, not a username

Nav Forgot password? goes here. That path is reserved, like /login and /signup.

The form never leaks a reset code

POST always returns the generic message. It does not reveal whether the email exists.

Native uses the same forgot API

iOS ResetPasswordFlow and Android splash call POST /api/v1/auth/forgot. Same generic copy.