0Pricing
AI Powered SaaS: Stripe + Auth + Billing + Deploy · Lesson

Password Reset & Email Verification

Build secure account recovery and email verification flows using one-time tokens, expiry, and transactional email so users can safely regain access.

Password Reset & Email Verification is a free AI Powered SaaS: Stripe + Auth + Billing + Deploy lesson on CoddyKit — lesson 4 of 4. You can read the complete lesson below for free — then practise it hands-on in the browser with a built-in code editor and a 24/7 AI tutor. It is part of the AI Powered SaaS: Stripe + Auth + Billing + Deploy learning path, one of 4 lessons in the course, and your progress syncs across the web and the CoddyKit app.

Why Reset & Verify?

Users forget passwords and mistype emails. A safe password reset flow lets them recover without support, and email verification confirms the address really belongs to them, cutting spam and fake accounts.

The Token Strategy

Both flows rely on a one-time token: a random, unguessable string emailed to the user. Possessing it proves control of the inbox.

import crypto from 'crypto';
const token = crypto.randomBytes(32).toString('hex');

Storing the Token Hashed

Never store the raw token. Hash it before saving so a database leak cannot be used to reset accounts. Compare hashes when the user returns.

const hash = crypto.createHash('sha256').update(token).digest('hex');
await prisma.resetToken.create({
  data: { userId, hash, expiresAt }
});

Adding Expiry

Tokens must expire — usually 15 to 60 minutes. Store an expiresAt timestamp and reject tokens past it.

const expiresAt = new Date(Date.now() + 30 * 60 * 1000);

Requesting a Reset

The user submits their email. Generate a token, save its hash, and email a link containing the raw token. Always respond the same way to avoid leaking which emails exist.

const link = process.env.APP_URL + '/reset?token=' + token;
await sendEmail(email, 'Reset your password', link);

Sending Transactional Email

Use a provider like Resend or SendGrid for reliable delivery. Keep the message short with a clear single action.

import { Resend } from 'resend';
const resend = new Resend(process.env.RESEND_API_KEY);
await resend.emails.send({ to, subject, html });

Verifying the Token

When the user opens the link, hash the incoming token, look it up, and check it is unused and unexpired.

const hash = crypto.createHash('sha256').update(token).digest('hex');
const record = await prisma.resetToken.findFirst({
  where: { hash, expiresAt: { gt: new Date() }, usedAt: null }
});

Updating the Password

If valid, hash the new password and save it, then mark the token used so it cannot be replayed.

const pw = await bcrypt.hash(newPassword, 12);
await prisma.user.update({ where: { id: record.userId }, data: { password: pw } });
await prisma.resetToken.update({ where: { id: record.id }, data: { usedAt: new Date() } });

Email Verification Flow

Verification works the same way: on signup, email a token. When clicked, set emailVerified on the user and invalidate the token.

await prisma.user.update({
  where: { id }, data: { emailVerified: new Date() }
});

Preventing Abuse

Protect these endpoints:

  • Rate limit reset requests
  • Give identical responses for known and unknown emails
  • Allow only one active token per user

Best Practices

Build recovery securely:

  • Use random, hashed tokens with expiry
  • Send via a transactional email provider
  • Mark tokens used after one use
  • Rate limit and avoid email enumeration

Quick Check

Test your reset-flow knowledge.

Recap

You built account recovery:

  • Generate random tokens, store them hashed with expiry
  • Email links via a transactional provider
  • Verify, then update the password and mark the token used
  • Reuse the pattern for email verification and guard against abuse

Users can now safely recover and verify accounts.

Frequently asked questions

Is the “Password Reset & Email Verification” lesson free?

Yes — the full text of “Password Reset & Email Verification” is free to read here on the web, and the AI Powered SaaS: Stripe + Auth + Billing + Deploy course includes 4 lessons in total. To practise it interactively (a built-in code editor and a 24/7 AI tutor) and unlock the rest of the AI Powered SaaS: Stripe + Auth + Billing + Deploy course, upgrade to CoddyKit PRO.

What will I learn in “Password Reset & Email Verification”?

Build secure account recovery and email verification flows using one-time tokens, expiry, and transactional email so users can safely regain access. You practise AI Powered SaaS: Stripe + Auth + Billing + Deploy with hands-on code you run directly in the browser, and a 24/7 AI tutor answers your questions as you work through the lesson.

Do I need any experience to start AI Powered SaaS: Stripe + Auth + Billing + Deploy?

No prior experience is required. AI Powered SaaS: Stripe + Auth + Billing + Deploy on CoddyKit is structured for beginners through advanced learners; this is — lesson 4 of 4, so you can start here or from the beginning and move at your own pace.

How long does the “Password Reset & Email Verification” lesson take?

Most CoddyKit lessons take about 5–10 minutes. Each one is bite-sized and interactive, so you make steady progress and pick up exactly where you left off across the web and the app.

Can I write and run code in this AI Powered SaaS: Stripe + Auth + Billing + Deploy lesson?

Yes. Every AI Powered SaaS: Stripe + Auth + Billing + Deploy lesson includes a built-in code editor, so you write and run real code right in your browser and get instant AI feedback — no local setup required.

All lessons in this course

  1. User Registration & Hashing
  2. Login & JWT Generation
  3. Protected Routes & Middleware
  4. Password Reset & Email Verification
← Back to AI Powered SaaS: Stripe + Auth + Billing + Deploy