PandaIDX

Request Password Reset

Emails the visitor a password reset link and a 6-digit code. It is the first step of the reset flow.

POST/v1/auth/request-password

Authentication

Public key?key=pk_…

Public key in the `key` query parameter. No OAuth, no secret.

Edge cache: no-store

Query Parameters

keystring
required

The site's public key (pk_…). It selects the account. Safe to ship to the browser.

Body Parameters

emailstring
required

The email of the visitor's account.

Responses

200Success
application/json
titlestring
hideToastboolean
typestring
variantstring
messagestring

Errors

400Invalid email, or no registered account with that email (`message: "User not found"`). Error bodies have `type: "error"`, `message` and an inner `status`.
401Missing or invalid public key.
429Too many attempts. Wait for the `Retry-After` header (900 seconds). The body is `{ type: "error", message }`.
403The Panda account is not active. The body also carries `code: "TENANT_INACTIVE"`.

Notes

  • The email has a link back to the site the visitor is on (`?auth=reset-password&token=…`) and a 6-digit code. Both work for 15 minutes.
  • The link points to the request's `Origin` when it is one of the site's own domains, otherwise to the site's main domain.
  • Limit: 10 requests per 15 minutes per visitor IP and site, shared with Verify Reset Code.
Request
curl --request POST \
  --url "https://api.pandaidx.com/v1/auth/request-password?key={{public_key}}" \
  --header "Content-Type: application/json" \
  --data '{"email":"alex.example@example.com"}'
Response200 OK
{
  "title": "You will receive an email to reset your password",
  "hideToast": false,
  "type": "success",
  "variant": "default",
  "message": "You will receive an email to reset your password"
}