Peek at a password-reset token without consuming it

GET/api/auth/password/reset/verify

verifyPasswordReset

Anonymous, idempotent. Returns 200 with the bound account handle so the SPA can show "Reset password for {handle}" before the user picks a new password. Returns 410 with `{ error: "invalid_or_expired" }` for missing / consumed / expired / wrong-purpose / bound_password_hash-drifted tokens. Does NOT consume the token.

Authentication is not described for this operation in the spec — that does not mean it is public. Check tokens and scopes.

curl

curl -X GET 'https://neosource.dev/api/auth/password/reset/verify?token=TOKEN'

fetch

fetch("https://neosource.dev/api/auth/password/reset/verify?token=TOKEN", {
  method: "GET",
});

Query parameters

tokenrequired: string

Responses

200Token is live and bound to an account

application/json

PasswordResetVerifyResponse

object

Response body for `GET /api/auth/password/reset/verify?token=…`. 200 with the bound account's handle when the token is live; 410 (no body schema — `ApiError` shape) for any failure mode.

handlerequired: string

Standard errors

Bodies documented once for the whole API — see standard errors.

400Bad Request — one of: invalid_input
410Gone — one of: invalid_or_expired
429Rate limited — retry after the `Retry-After` header
500Internal server error
503Service temporarily unavailable / at capacity — retry after the `Retry-After` header
504Gateway timeout — the request exceeded the server's handling budget