{
  "id": 1384156,
  "title": "How Do I Send Password Reset Emails from a Backend App Using an Email API?",
  "url": "https://urgent.news/2026/08/17/how-do-i-send-password-reset-emails-from-a-backend-app-using-an-email",
  "topic": "tech",
  "section": "Tech",
  "published": "2026-08-17T00:20:45.000Z",
  "source": {
    "name": "Dev.to",
    "slug": "dev-to",
    "url": "https://dev.to/gaeldan/how-do-i-send-password-reset-emails-from-a-backend-app-using-an-email-api-2c09"
  },
  "original_language": "en",
  "account": "Resetting a user's password typically involves generating a secure token, sending a reset link via email, and then verifying that token when the user submits a new password. This process can be executed using an email API. Here's a step-by-step breakdown:\n\n1. Generate the Reset Token: Utilize a cryptographically secure random value generator, like the `crypto` module in Node.js. Don't use a guessable value. Store only a hashed version of the token in the database to protect it. Generate a token with a short expiration time, typically 15 to 60 minutes.\n\n2. Build the Reset URL: Construct a URL that includes the reset token as a parameter. This URL will be the link users click to reset their passwords. The hashed token is stored for verification later.\n\n3. Send the Email: Use an email API to send the password reset email. In this example, Notify is used. The process involves making an HTTP POST request to Notify's API endpoint, including the email address, your app's verified domain, and a link with the token. If you want to handle bounced emails, set up a webhook to receive notifications.\n\n4. Verify the Token: When the user submits the new password, verify the token using the same hashing algorithm. Check that the token exists and has not expired. Upon successful verification, update the user's password and invalidate the token to prevent reuse.",
  "summary": "Here's the full flow the way I've built it, using Notify as the email API. The shape of this is the same regardless of which provider you pick — generate a token, send a link, verify it on submit — so most of this applies no matter what you're using; I'll flag the one part that's specific to Notify. The Flow, End to End User requests a password reset Your backend generates a secure, short-lived…",
  "key_points": [
    "Generate secure reset token using cryptographically secure random value generator.",
    "Build reset URL with hashed token as parameter for password verification.",
    "Send password reset email via email API, handling bounced emails with webhook."
  ],
  "editors_take": "Using an email API to send password reset links streamlines the password recovery process, enabling developers to focus on building core app functionality while maintaining secure token-based authentication.",
  "illustration": null,
  "coverage": {
    "outlets": 1,
    "also_reported_by": []
  },
  "ai_generated": true,
  "disclaimer": "Summaries, key points and the editor’s take are written by software from other outlets’ reporting and may contain errors — always check the linked original."
}