Determines if the given token in the URL is correct, unexpired, and unused.
This endpoint verifies the password reset. The endpoint determines if the given token in the URL is correct or not. Prevents the user from entering a new password without valid access. Returns a "404 page not found" error if the token is wrong.
Password reset tokens expire after 14 days. If a token has expired, the endpoint returns a 404 status with an ["expired"] response body. If a token has already been used to reset a password, the endpoint returns a 404 status with an ["already used"] response body. This distinction allows the client to display appropriate messaging — for example, offering to send a fresh reset link when a token has expired.
Response Structure
| Code | Response | Reason |
|---|---|---|
| 200 | Success | The token is valid and has not expired. |
| 404 | ["expired"] | The token has exceeded the 14-day expiry window. |
| 404 | ["already used"] | The token has already been used to reset a password. |
| 404 | Not Found | The token does not exist. |
