curl -X POST https://api.dotlookup.dev/v1/auth/forgot-password \
-H "Content-Type: application/json" \
-d '{"email": "you@example.com"}'
{
"message": "if an account with that email exists, a reset link has been sent"
}
Account
Forgot Password
Request a password-reset link by email
POST
/
v1
/
auth
/
forgot-password
curl -X POST https://api.dotlookup.dev/v1/auth/forgot-password \
-H "Content-Type: application/json" \
-d '{"email": "you@example.com"}'
{
"message": "if an account with that email exists, a reset link has been sent"
}
Triggers a password-reset email if an account exists at the supplied address. The response is always 200 — DotLookup intentionally doesn’t disclose whether an email is registered, to prevent account enumeration.
The email contains a link in the form
string
required
Email of the account to reset
curl -X POST https://api.dotlookup.dev/v1/auth/forgot-password \
-H "Content-Type: application/json" \
-d '{"email": "you@example.com"}'
{
"message": "if an account with that email exists, a reset link has been sent"
}
https://dotlookup.dev/reset-password?token=<token>. The token is single-use, expires after 1 hour, and is stored hashed server-side — the raw value only exists in the email.
Pair this endpoint with POST /v1/auth/reset-password to complete the flow.