Forgot Password Without Magic Link

Ask us anything
1

I’m looking at the Magic Link setup with Xano for the forgot password flow. It honestly looks like a whole lot of work and a ton of stuff that could go wrong (lots in the forums and YT comments about issues with it).

Is there any reason why I shouldn’t just create my own flow that has Xano create a random code that expires after 5 mins, and email that code to the user, then have them use that code to validate a form field that allows them to update their password?

My plan is to Generate a 8 digit number that expires after 5mins and gets emailed to the user while being stored in a field under the user. Then have a form that asks for email and code, upon submitting it runs a GET /user and searches for the user with that email and code. Then I show an update password form.

This should work right? (I’m going to try building it while I wait for a reply lol) Is there a reason why this route might be a bad idea or is there a better way?

I’m sure I’m not the only Xano user that doesnt want to use a magic link with Send Grid.

2

Yeah that should work, this is essentially how these magic links work.
You can probably skip the step of entering the email and code, instead just use the endpoint for updating the password to have the code as input parameter and match the user based on the code.