Password reset

Token generation and email delivery are isolated behind the API architecture.