Account recovery

Recover access without exposing account information.

Production recovery will use a short-lived verification link and will not reveal whether an arbitrary email address belongs to an account.

ResponseNeutralThe workflow does not disclose whether an arbitrary account exists.
TokenShort-livedRecovery links remain single-use and time-limited.
SessionsRevocableExisting sessions can be revoked after recovery.
StatusComing soonOnline account recovery is being prepared.

The production response will remain neutral to prevent account enumeration.

Recovery flow

01RequestEmail submitted
โ†’
02Short-lived tokenSingle-use link
โ†’
03New credentialSecure reset
โ†’
04AuditSessions reviewed/revoked as required