Account recovery

Request a workforce password reset

Recovery email is a first-class Auth flow. Responses stay generic so Console does not reveal whether a workforce account exists for the email you enter.

Local auth configuration is incompleteSet DOPAL_CONSOLE_SESSION_SECRET before testing recovery flows locally.

Security Baseline

Trusted web boundary first

Console is the workforce web front door. It is not a web fallback for Operator, and it should not expose raw workforce bearer tokens to browser JavaScript.

HTTP-only sealed session cookies keep browser scripts away from Auth tokens.
State-changing app routes require same-origin requests and no-store responses.
Operator updates remain a signed installer plus updater milestone after this branch.

Current Branch Scope

Thin but real

This branch establishes Console route boundaries, a secure login bridge, and self-service flows backed by existing Auth APIs. Invite acceptance and subscription visibility stay explicit placeholders until their backend contracts exist.

Need Help

If your invite or download surface is not ready yet, contact [SENSITIVE] and include the route you were trying to use.