Skip to content

The v1 docs follow nauthera-server's main branch and its 0.x releases on the way to 1.0, so fields and APIs can still change.

v1

invalid_reset_link

Docs version v1 (main)Nauthera is pre-1.0, in a design-partner program

The password-reset link is unknown, expired, used or another organization's (400).

Meaning

POST /v1/auth/password-reset/confirm refuses a token it does not hold for this organization: one that expired (auth.password_reset.validity), was already used, belongs to another organization, or was never issued. The answer is the same for each.

Impact

The user cannot set a new password with this link. It is expected for an old email or a link clicked twice, including by a mail scanner that opened it first.

Diagnosis

Look the request id up on the Troubleshooting page. The refusal is recorded as auth.password_reset.completed with reason invalid_token and cause reset_link_unknown.

Mitigation

  • As a user: ask for a new link from "Forgot password" and use the newest email.
  • As an operator: if links expire before users reach them, lengthen auth.password_reset.validity.

Escalation

Escalate when a freshly sent link is refused on first use. Open an issue with the request id and the server version. Never attach the link or its token.

Problem code runbooks · Generated from internal/runbook/problems.yaml in nauthera-server.