Password reset

Password reset allows users to securely reset forgotten passwords. Neon Auth supports password reset via verification links sent to the user's email address.

Enable password reset

In your project's Settings → Auth page, ensure Sign-up with Email is enabled. Password reset is automatically available when email authentication is enabled.

Using UI components

The easiest way to add password reset is using the pre-built UI components <ForgotPasswordForm> and <ResetPasswordForm>.

1. Enable forgot password in AuthView

If you're using <AuthView>, enable the forgot password flow:

import { NeonAuthUIProvider } from '@neondatabase/neon-js/auth/react';
import { AuthView } from '@neondatabase/neon-js/auth/react/ui';
import { authClient } from './auth';

export default function App() {
  return (
    <NeonAuthUIProvider authClient={authClient}>
      <AuthView pathname="sign-in" credentials={{ forgotPassword: true }} />
    </NeonAuthUIProvider>
  );
}

The <AuthView> component automatically includes a "Forgot password?" link when forgotPassword is enabled.

2. Use standalone form components

For more control, use <ForgotPasswordForm> and <ResetPasswordForm> separately:

import { useState } from 'react';
import { ForgotPasswordForm, ResetPasswordForm } from '@neondatabase/neon-js/auth/react/ui';
import { authClient } from './auth';

export default function App() {
  const [step, setStep] = useState<'forgot' | 'reset'>('forgot');
  const [email, setEmail] = useState('');

  if (step === 'forgot') {
    return (
      <ForgotPasswordForm
        authClient={authClient}
        redirectTo={`${window.location.origin}/reset-password`}
        onSuccess={(data) => {
          setEmail(data.email);
          setStep('reset');
        }}
      />
    );
  }

  return (
    <ResetPasswordForm
      authClient={authClient}
      email={email}
      onSuccess={() => {
        setStep('forgot');
        // Redirect to sign-in or show success message
      }}
    />
  );
}

Password reset flow

The complete password reset flow works as follows:

1. User requests reset: User enters their email and clicks "Send reset link"
2. Email sent: User receives a verification link with a reset token
3. User clicks link: User is redirected to your app's reset password page
4. User enters new password: User submits the new password
5. Password reset: Password is updated and user is signed in (if auto-sign-in is enabled)

Reset link expiration

Password reset links expire after 15 minutes. If a link expires, users need to request a new one.

Next steps

• Add email verification to ensure users own their email addresses
• Learn how to branch your auth to use database branches with isolated auth environments