Skip to main content

Password reset

A user who forgot their password asks for a link by email and chooses a new password on a page in your app. It needs email sending.

await nb.collection("users").requestPasswordReset("ann@example.com");

The call resolves the same way whether or not the address belongs to an account, so it reveals nothing about who has signed up.

Set the new password​

The email links to /reset-password?token=... in your app. That page asks for the new password and confirms it:

app/reset-password/actions.ts
"use server";
import { serverClient } from "@nextbasejs/next";
import { redirect } from "next/navigation";
import { nextbase } from "@/lib/nextbase";

export async function resetPassword(form: FormData) {
  const nb = await serverClient(nextbase);
  await nb
    .collection("users")
    .confirmPasswordReset(
      String(form.get("token")),
      String(form.get("password")),
      String(form.get("passwordConfirm")),
    );
  redirect("/sign-in");
}

After a reset:

  • the link cannot be used again,
  • every session of the account ends, so the user signs in again,
  • the email counts as verified, since the user proved they receive it,
  • a sign-in block from failed attempts is lifted,
  • the owner gets an email saying the password changed.