Set a new password

Password must be 8+ characters

assertResetPassword and the API schema both require 8–200 characters.

Code lasts 60 minutes

The emailed link expires after one hour. Request a new one at /forgot.

A valid update lands on Log in

After update, web opens /login?reset=1. Native returns to the splash login step.

Redirects stay on Kumir

redirectFromSearch only allows same-origin paths. Default return is /login.

Request a new link goes to /forgot

This page does not email a new code. /forgot is the request step.

Not Forgot password

Asking for a code is /forgot. This page only applies one.

Not Verify email

Confirming a new account is /verify. Reset does not set emailVerifiedAt.

Not Log in

Already know the password? /login. This page does not check the old one.

No invented Resend key

EMAIL_PROVIDER=resend only when RESEND_API_KEY is set. Otherwise Kumir logs.

/reset is reserved, not a username

The emailed link opens here. That path is reserved, like /forgot and /login.

The form never fakes a password update

Update only runs after a valid sha256 digest. It does not mint passwordHash otherwise.

Native uses the same reset API

iOS ResetPasswordFlow and Android splash call POST /api/v1/auth/reset. Same 8+ rule.