Request a password reset link for a customer. The customer is identified by email, scoped to the site. The reset token is delivered by email only — it is never returned in the response — so the reset must be completed by the customer from the emailed link. An email that does not match a customer on the site returns 404.
| Time | Status | User Agent | |
|---|---|---|---|
Retrieving recent requests… | |||
Overview
Send a password reset link to a customer's email. Public — no authentication required.
Example: A customer taps "Forgot password?"; call this endpoint with their email to send the reset link.
The customer is looked up by email, scoped to the site given in site_id. The same address on a different site is a different customer.
The reset token is never returned
The token is delivered in the email only. It is not present in the response, so this endpoint cannot be used to reset a password directly — the customer must complete the reset from the emailed link.
Local and testing environmentsThe token is included in
dataonly when the application runs inlocalortestingmode, so automated tests can complete the flow. It is never returned in sandbox, staging, or production.
Which email is sent
If the site has the Password Reset template enabled in Email Center, the email is sent through Email Center. Otherwise Pelcro's built-in password-reset notification is used. Either way exactly one email is sent.
Unknown email addresses
An unknown email returns 404 Invalid credentials! Please try again., while a known email returns 200. The response therefore distinguishes between the two — do not rely on this endpoint to conceal whether an account exists on the site.
Conditional Requirements
| Condition | Required Fields |
|---|---|
| Always | email |