BuildWithHQBuilder console

Locked out? Back in a minute.

Password resets are single-use and time-boxed, and revoke the rest of your active sessions.

Design preview · representative content

Reset your password

Enter your account email and we'll send a reset link if it matches an account.

For your security, we show the same confirmation whether or not an account exists.

← Back to sign in

About this page

Enter your email and, if an account exists, a one-time reset link goes out. The screen says the same thing either way — that’s deliberate, so nobody can use this form to discover which emails have accounts.

Behind this page/forgot-password · public

Retrieve

No read. Email is looked up server-side only to decide whether to mint a token.

Save

sp_Auth_CreatePasswordResetToken stores a hashed, expiring token; the raw token is emailed, never returned.

Success

  • Always returns the same generic success.
  • Rate-limited per email/IP.
  • No account-existence disclosure.

CLI handoff

Implement this scaffold from the structured contract, then remove hard-coded preview rows. The source of truth is CLI Handoff and admin-cli-manifest.json.

Page IDforgot-password
Route/forgot-password
Accesspublic
Statusschema-backed-scaffold

Server-inject identity and scope values; never trust browser-supplied account, app, tenant, user, entitlement, price, or permission identifiers. Preserve the loading, empty, forbidden, failed, retrying, and completed states shown by the preview.