# Forgot password

- **Route:** `/register/reset/request`
- **API:** POST /v1/auth/password-reset
- **Visual reference:** `source/RenewCMS Screens Auth.dc.html`, group "Forgot password" (open it in a browser; each state is drawn at desktop and mobile, with a light/dark toggle).

The sent state reads the same whether or not the email exists, so the page doesn't reveal which emails have accounts.

## States

### Default

**Trigger:** From "Forgot password?" on log in.

- Heading: **Reset your password**
- Description: "Enter the email for your account and we'll send you a link to choose a new password."
- Field `Email`: placeholder "you@example.com"
- Submit button: "Send reset link"
- Below the card: [Back to log in]

### Validation error

**Trigger:** Invalid email on submit. Nothing is sent.

- Heading: **Reset your password**
- Description: "Enter the email for your account and we'll send you a link to choose a new password."
- Field `Email`: placeholder "you@example.com"; value "marta@renew"; **error "Enter a full email address, like name@example.com."**
- Submit button: "Send reset link"
- Below the card: [Back to log in]

### Submitting

**Trigger:** Request in flight.

- Heading: **Reset your password**
- Description: "Enter the email for your account and we'll send you a link to choose a new password."
- Field `Email`: placeholder "you@example.com"; value "marta@renew.example"
- Submit button: "Sending…", loading
- Below the card: [Back to log in]

### Sent

**Trigger:** Any 200, whether or not the account exists.

- ResultPanel (success, mail-check): **Check your email**; text "If an account exists for that email, a password reset link has been sent."; note "The link expires in 1 hour."; actions "Back to log in" (secondary)

### Too many attempts (429)

**Trigger:** Rate limit with Retry-After.

- Relied on an API marked pending in the design; that API now exists.
- Alert (info, timer): **Too many requests** "Wait a moment before asking for another link."
- Heading: **Reset your password**
- Description: "Enter the email for your account and we'll send you a link to choose a new password."
- Field `Email`: placeholder "you@example.com"; value "marta@renew.example"
- Submit button: "Try again in 0:58", disabled
- Below the card: [Back to log in]

### Server error

**Trigger:** 500 or no response.

- Alert (error, circle-x): **Couldn't send the link** "Check your connection and try again."
- Heading: **Reset your password**
- Description: "Enter the email for your account and we'll send you a link to choose a new password."
- Field `Email`: placeholder "you@example.com"; value "marta@renew.example"
- Submit button: "Send reset link"
- Below the card: [Back to log in]