# invalid_reset_link

The password-reset link is unknown, expired, used or another organization's (400).

## Meaning

`POST /v1/auth/password-reset/confirm` refuses a token it does not hold for this
organization: one that expired (`auth.password_reset.validity`), was already used,
belongs to another organization, or was never issued. The answer is the same for
each.

## Impact

The user cannot set a new password with this link. It is expected for an old email
or a link clicked twice, including by a mail scanner that opened it first.

## Diagnosis

Look the request id up on the Troubleshooting page. The refusal is recorded as
`auth.password_reset.completed` with reason `invalid_token` and cause
`reset_link_unknown`.

## Mitigation

- As a user: ask for a new link from "Forgot password" and use the newest email.
- As an operator: if links expire before users reach them, lengthen
  `auth.password_reset.validity`.

## Escalation

Escalate when a freshly sent link is refused on first use. Open an issue with the
request id and the server version. Never attach the link or its token.

---

[Problem code runbooks](https://www.nauthera.io/docs/v1/runbooks/problems) · Generated from [`internal/runbook/problems.yaml`](https://github.com/nauthera/nauthera-server/blob/main/internal/runbook/problems.yaml) in nauthera-server.