{
  "id": 8977387,
  "title": "Custom Password Reset API Selection for Auth Systems Without Webhooks",
  "url": "https://urgent.news/2026/09/21/custom-password-reset-api-selection-for-auth-systems-without-webhooks",
  "topic": "tech",
  "section": "Tech",
  "published": "2026-09-21T18:16:11.000Z",
  "source": {
    "name": "Dev.to",
    "slug": "dev-to",
    "url": "https://dev.to/mirageb18/custom-password-reset-api-selection-for-auth-systems-without-webhooks-58p0"
  },
  "original_language": "en",
  "account": "The crux of the decision is balancing evidence reliability against tight coupling to a specific email service. By introducing an intermediary outbox layer, your application can record a durable submission result while maintaining flexibility. Store a unique message key, capture the remote message identifier, and periodically poll for unresolved messages.\n\nFor password resets, the proof needed is the reset request and token expiration. For order receipts, it's the immutable payment reference. Avoid storing raw reset tokens in logs. Only log the status code, response time, provider message ID, and a hash of the message content.\n\nThe API should give you a stable message identifier and allow querying message events. A polling design works best here. If you can only push events or manually search a dashboard, the compliance record will be incomplete without webhooks.\n\nModel the data flow in your code: when payment settles or an auth request occurs, write an outbox row in the same transaction. A worker will claim the row, render a versioned template, submit through a narrow transport interface, and store the result. A separate reconciler will then poll only the submitted rows with open outcomes.\n\nDefine constants for message purpose (password_reset, order_receipt) and delivery states (submitted, delivered, delayed, bounced, unknown). Create interfaces for OutboundMessage, SubmissionEvidence, DeliveryObservation, and EmailTransport.\n\nImplement a function to submit messages. Check if the message has expired and throw an error if so. Use an HTTP POST request with an idempotency key derived from the message key. If the response is not successful, throw an error with the status. Parse the JSON response and store the id.",
  "summary": "The most important trade-off is evidence versus coupling: for password recovery and settled-order receipts, choose an email API that lets your application record a durable submission result and later reconcile delivery events without making either workflow depend on a provider-specific webhook. Short answer: put an outbox between the business event and the email API, assign your own stable…",
  "key_points": [
    "Store unique message key and remote message identifier for password resets and order receipts.",
    "Poll for unresolved messages and avoid storing raw reset tokens in logs."
  ],
  "editors_take": null,
  "illustration": null,
  "coverage": {
    "outlets": 2,
    "also_reported_by": [
      {
        "outlet": "Dev.to",
        "title": "Custom Password Reset Email API Selection — Auth Template Ownership Without Webhooks",
        "url": "https://urgent.news/2026/09/21/custom-password-reset-email-api-selection-auth-template-ownership",
        "published": "2026-09-21T16:40:20.000Z"
      }
    ]
  },
  "ai_generated": true,
  "disclaimer": "Summaries, key points and the editor’s take are written by software from other outlets’ reporting and may contain errors — always check the linked original."
}