Password reset

Password reset allows users to securely reset forgotten passwords. Managed Better Auth supports password reset via verification links sent to the user's email address.

In your project's Settings → Auth page, ensure Sign-up with Email is enabled. Password reset is automatically available when email authentication is enabled.

The easiest way to add password reset is using the pre-built UI components <ForgotPasswordForm> and <ResetPasswordForm>.

If you're using <AuthView>, enable the forgot password flow:

import { NeonAuthUIProvider, AuthView } from '@neondatabase/auth-ui';
import { authClient } from './auth';

export default function App() {
  return (
    <NeonAuthUIProvider authClient={authClient}>
      <AuthView pathname="sign-in" credentials={{ forgotPassword: true }} />
    </NeonAuthUIProvider>
  );
}

The <AuthView> component automatically includes a "Forgot password?" link when forgotPassword is enabled.

For more control, use <ForgotPasswordForm> and <ResetPasswordForm> separately:

import { useState } from 'react';
import { ForgotPasswordForm, ResetPasswordForm } from '@neondatabase/auth-ui';
import { authClient } from './auth';

export default function App() {
  const [step, setStep] = useState<'forgot' | 'reset'>('forgot');
  const [email, setEmail] = useState('');

  if (step === 'forgot') {
    return (
      <ForgotPasswordForm
        authClient={authClient}
        redirectTo={`${window.location.origin}/reset-password`}
        onSuccess={(data) => {
          setEmail(data.email);
          setStep('reset');
        }}
      />
    );
  }

  return (
    <ResetPasswordForm
      authClient={authClient}
      email={email}
      onSuccess={() => {
        setStep('forgot');
        // Redirect to sign-in or show success message
      }}
    />
  );
}

The complete password reset flow works as follows:

1. User requests reset: User enters their email and clicks "Send reset link"
2. Email sent: User receives a verification link with a reset token
3. User clicks link: User is redirected to your app's reset password page
4. User enters new password: User submits the new password
5. Password reset: Password is updated and user is signed in (if auto-sign-in is enabled)

Password reset links expire after 15 minutes. If a link expires, users need to request a new one.

• Add email verification to ensure users own their email addresses
• Customize the application name shown in password reset emails
• Learn how to branch your auth to use database branches with isolated auth environments