Passwords and recovery

Password rules, password reset, changing the e-mail address and re-authentication.

#Password requirements

In Studio → Authentication → Settings set the minimum length (6 to 72, default 6) and which characters are required: none, letters and digits, lower case + upper case + digits, or lower case + upper case + digits + symbols. Weak passwords are rejected with an error that the SDK returns.

#Reset a forgotten password

JavaScript

// 1. Send the e-mail
await stitchdb.auth.resetPasswordForEmail('[email protected]', { redirectTo: 'https://example.com/reset' })

// 2. On /reset the link has signed the user in; ask for the new password
stitchdb.auth.onAuthStateChange(async (event) => {
  if (event === 'PASSWORD_RECOVERY') {
    await stitchdb.auth.updateUser({ password: 'a-new-password' })
  }
})

#Change the password

JavaScript

await stitchdb.auth.updateUser({ password: 'a-new-password' })

With Require reauthentication to change password on, the user first asks for a code and passes it as the nonce:

JavaScript

await stitchdb.auth.reauthenticate()   // sends a code by e-mail
await stitchdb.auth.updateUser({ password: 'a-new-password', nonce: '123456' })

#Change the e-mail address

JavaScript

await stitchdb.auth.updateUser({ email: '[email protected]' }, { emailRedirectTo: 'https://example.com/account' })

The new address gets a confirmation link; with Secure e-mail change on (the default) the old address must confirm as well. The address changes once confirmed.

#Admins

From Studio → Authentication → Users you can send a recovery e-mail, copy a recovery link or set a new password for a user. See Manage users.