Table of Contents

Recover and reset a password

Last updated:

The recovery flow has two separate operations: accept a recovery request without disclosing account existence, then consume the delivered opaque token with a new password.

Prerequisites

  • Resolve IAccountApplication.
  • Configure durable transactional-email delivery.
  • Keep email addresses, reset tokens, and passwords out of ordinary logs and telemetry.

Request recovery

var request = new RequestPasswordResetCommand("alex@example.com");

OperationResult<RecoveryAccepted> result =
    await accountApplication.RequestPasswordResetAsync(
        request,
        cancellationToken);

Registered and unregistered addresses produce the same safe accepted shape where the request itself is valid. The result does not disclose whether email was sent.

Reset the password

var command = new ResetPasswordCommand(
    token,
    "<new-password>");

OperationResult result =
    await accountApplication.ResetPasswordAsync(
        command,
        cancellationToken);

Invalid, expired, consumed, superseded, or incompatible tokens return token_invalid_or_expired without exposing the internal classification.

Session consequences

Successful reset replaces the credential and revokes existing sessions. Old passwords and previously issued cookies must no longer authenticate.

Verify the result

After reset:

  1. confirm the reset operation succeeded;
  2. confirm an existing session no longer produces an authenticated account context;
  3. sign in using only the replacement password;
  4. confirm the reset token cannot be replayed.

Troubleshooting

An accepted recovery result is not evidence that an account exists or that delivery completed. Use bounded durable-delivery diagnostics for provider failures.

Next steps

Review Sign in with a password and Authentication sessions.