Password Recovery

Definite supports two password-recovery paths for local password accounts.

Self-service reset with email

If email.mode is smtp or definite_cloud, users can click Forgot password? on /login, enter their email, and receive a single-use reset link. The link expires after 24 hours. When the password is changed, all existing sessions for that user are revoked.

Definite uses a generic SMTP relay. Common choices are Amazon SES, Postmark, SendGrid, Mailgun, Google Workspace relay, Exchange Online relay, or an internal company SMTP relay.

email:
  mode: smtp
  enabled: true
  from: "Definite <no-reply@example.com>"
  smtp:
    host: "smtp.example.com"
    port: 587
    username: "smtp-user"
    password:
      env: EMAIL_SMTP_PASSWORD
    starttls: true
    ssl: false

Definite-managed hosted deployments use email.mode: definite_cloud, which relays through Definite Cloud instead of storing a provider credential in the customer deployment.

Password reset is only available for active local-password users. SSO users recover access through their identity provider.

No-email recovery

If email is disabled or incomplete, /login shows recovery instructions instead of a reset-link form.

If another workspace admin can sign in, they can reset the user's password from Settings -> Members and share the temporary password out-of-band.

If all admins are locked out, an operator with Kubernetes access can run:

kubectl -n <namespace> exec -it <api-pod> -- \
  definite admin reset-password user@example.com

See operator-recovery.md for the full lockout runbook.