Account recovery

Account recovery is how a person gets back in after forgetting a password. It is the most abused flow in any app, so the defaults are cautious.

Account recovery page — Users & auth → Account recovery.

In Studio

Users & auth → Security → Account recovery.

Setting	Meaning	Key
Self-service password reset	Off: nobody can reset their own password; an administrator sets it	`directory.recovery.enabled`
Reset link lifetime	Minutes. A link works once. Default 60	`directory.recovery.link_minutes`
Sign out everywhere after a reset	Anyone who had the old password loses their session. Default on	`directory.recovery.revoke_sessions`
Email the person when their password is reset	So they notice if it wasn’t them. Default on	`directory.recovery.notify_change`

Change the wording under Email templates: Reset your password and Password changed.

The two-step client flow

Request. On “Forgot password”, ask for the email.
Reset. Pawabase mails a link to your redirectTo page. That page reads the token and sets the new password.

// 1. On "Forgot password"
await pawabase.auth.requestPasswordReset({ email, redirectTo: "https://myapp.com/reset" });

// 2. On /reset, with the token from the link
const token = new URL(location.href).searchParams.get("token")!;
const session = await pawabase.auth.resetPassword({ token, password: newPassword });

pb.auth.request_password_reset(email=email, redirect_to="https://myapp.com/reset")

session = pb.auth.reset_password(token=token, password=new_password)

requestPasswordReset always succeeds, whether or not the address has an account, so nobody can discover who has one. Your message should say “If an account exists, we sent a link.” resetPassword returns a session, so the person is signed in. The new password must satisfy the password policy, and history rules apply: they can’t reuse a recent password if you’ve set Remember previous passwords. The redirectTo page must be on your redirect list.

The landing page

function ResetPage() {
  const token = new URLSearchParams(location.search).get("token") ?? "";
  const [password, setPassword] = useState("");
  const [message, setMessage] = useState("");

  async function submit(e: React.FormEvent) {
    e.preventDefault();
    try {
      await pawabase.auth.resetPassword({ token, password });
      navigate("/");
    } catch (err) {
      if (err instanceof ValidationError) setMessage(err.fieldError("password") ?? "Choose a stronger password.");
      else setMessage("This link has expired. Request a new one.");
    }
  }

  return (
    <form onSubmit={submit}>
      <input type="password" autoComplete="new-password" value={password} onChange={(e) => setPassword(e.target.value)} />
      <button>Set new password</button>
      {message && <p>{message}</p>}
    </form>
  );
}

Account locked out?

Several things can stop a sign-in; know which you’re looking at:

Situation	Where to look
Forgot the password	This page
Too many wrong attempts	Attack protection: unlock in Studio or `users.update(id, { unlock: true })`
Lost their phone and backup codes	Two-step verification: reset their factors in Studio
Account disabled	Users: enable it again
Password expired	They use “Forgot password”

Recovering as an administrator

With self-service reset off, or for someone who can’t reach their email, set a password from Studio (Users → open the person → Password) or from a server with a secret key:

import { admin } from "@pawabase/client/admin";

await admin(pawabase).users.update(userId, { password: temporaryPassword, unlock: true });

pb.admin.users.update(user_id, password=temporary_password, unlock=True)

unlock also clears a lockout from too many failed sign-ins. Then tell them through a different channel, and ask them to change it at once.

Events

user.password_reset fires when a recovery link is used, and user.password_changed when a signed-in person changes theirs. See Auth webhooks.

Password policy

Rules for the new password.

Email verification

Confirming an address.

Getting started

Sign-in methods

Sign-up

Security

People

Developers

In Studio

The two-step client flow

The landing page

Account locked out?

Recovering as an administrator

Events

Password policy

Email verification

​In Studio

​The two-step client flow

​The landing page

​Account locked out?

​Recovering as an administrator

​Events

Password policy

Email verification

In Studio

The two-step client flow

The landing page

Account locked out?

Recovering as an administrator

Events