# Forgot password

Route: `/register/reset/request`. API: POST /v1/auth/password-reset.

The sent state reads the same whether or not the email exists, so the page doesn't reveal which emails have accounts.

Visual reference: `RenewCMS Screens Auth.dc.html`, groups "Forgot password". Frames: `AppFrame.dc.html` (shell, sidebar, topbar, drawer) plus the screen frame where listed in components.md.

## Copy per state (generated from the board source, pass 2)

Every state below is drawn in light and dark (theme switch on the board), at 1440×900 and 390×844 (both frames sit side by side). Board: `RenewCMS Screens Auth.dc.html`. Copy is exact; where a cell is empty the state reuses the fixed copy.

### Base copy
- Reset your password
- Enter the email for your account and we'll send you a link to choose a new password.
- Send reset link
- Back to log in

### Forgot password (group "Forgot password", 6 states)

Route: `/register/reset/request`. API: POST /v1/auth/password-reset.

The sent state reads the same whether or not the email exists, so the page doesn't reveal which emails have accounts.

| # | State | Trigger | Copy |
|---|---|---|---|
| 1 | Default | From "Forgot password?" on log in. |  |
| 2 | Validation error | Invalid email on submit. Nothing is sent. | "marta@renew" / "Enter a full email address, like name@example.com." |
| 3 | Submitting | Request in flight. | "marta@renew.example" / "Sending…" |
| 4 | Sent | Any 200, whether or not the account exists. | "Check your email" / "If an account exists for that email, a password reset link has been sent." / "The link expires in 1 hour." / "Back to log in" |
| 5 | Too many attempts (429) | Rate limit with Retry-After. | "Too many requests" / "Wait a moment before asking for another link." / "marta@renew.example" / "Try again in 0:58" |
| 6 | Server error | 500 or no response. | "Couldn't send the link" / "Check your connection and try again." / "marta@renew.example" |