Forgot password (Field)

Everyone can reset their own password from the sign-in page:

1. Click Forgot your password? and enter a username or email address.
2. Claimsfy emails a Choose a new password link. It works once, for 1 hour.
3. They pick a new password (at least 8 characters) and are signed in. Any other phone or computer signed in to that account is signed out.

What it needs

• Email delivery turned on: 👤 → Email & notifications → Email delivery, or the MAIL_ / SMTP_ settings. Until then, the page tells people to ask their administrator, who can still reset a password in 👥 Manage users.
• APP_URL set to your Claimsfy address, for example https://storm.yourcompany.com/. The link in the email always uses it. Without it, Claimsfy uses the address from Email delivery or the last address an administrator signed in at, never an address a visitor supplies.
• An email address on each account. Staff are asked for one at their first sign-in.

Built-in protections: the answer is the same whether or not an account exists, so nobody can test which emails have accounts. Each account gets at most 3 reset emails an hour, and each connection 15 requests every 15 minutes. Only a hash of the link is stored. Changing a password, or an administrator resetting one, signs out every other session for that account.