Password Recovery & Change

If a user forgets their password, they can request a reset link via email, then set a new password. Logged-in users can change their password directly.

Request Reset

await sdk.auth.forgotPassword('player@casino.com');

Anti-enumeration: this call ALWAYS resolves with the same generic success response, whether or not the identifier matches an account. Never reveal account existence through this flow; a would-be attacker learns nothing.

GIVEN any identifier (known account or not)
WHEN forgotPassword(identifier) is called
THEN the call resolves with the same generic success message,
     and an email with a reset link is sent ONLY if the account exists.

Password recovery is delivered by email; no SMS channel is supported.

Reset Password

When the user receives the email, they are taken to a page where they enter a new password. Pass the reset token and the new password to the SDK:

await sdk.auth.resetPassword('reset_token', 'newSecurePassword123');

Token delivery mechanism: the reset link places the token in the URL fragment (https://yourcasino.com/reset#token=abc123), never in the query string. Fragments are not sent to servers, not written to browser history entries shared with the page, and not leaked via Referer headers or proxy logs. Extract it with:

const token = new URLSearchParams(window.location.hash.slice(1)).get('token');

Resetting a password revokes every active session for the account. If a session was stolen, completing a password reset ends it immediately, so the user (and you) can treat a reset as a "kick everyone out" action.

GIVEN a valid reset token and a new password meeting strength rules
WHEN resetPassword(token, newPassword) is called
THEN the password is changed, every session for the account is revoked
     (all tabs fire session-expired), and the user must log in again.

Reset tokens are single-use, expire (default 60 minutes), and are revoked after too many failed attempts (see Rate Limiting).

Password strength rules (one definition, used by registration, resetPassword, and changePassword): passwords must be 10+ characters, containing letters and numbers; and passwords known to be compromised (breach-list match) are rejected, and the user is told to choose a different one.

Change Password (logged in)

await sdk.auth.changePassword({
  currentPassword: 'oldPassword123',
  newPassword: 'newSecurePassword123'
});

GIVEN a logged-in user
WHEN changePassword({ currentPassword, newPassword }) is called with the correct
     current password and a new password meeting strength rules
THEN the password is changed, the current session is preserved,
     and all OTHER sessions for the account are revoked.

A wrong currentPassword throws InvalidCredentialsError (AUTH_INVALID_CREDENTIALS).

Sandbox: there is no email provider, so the reset token is printed to the browser console when forgotPassword is called (the test frontend's Forgot Password page displays it directly). See Environments & Sandbox Data.