Skip to main content

Reset your password

Goal​

You've forgotten your Measured Cloud password (or want to change it without being signed in). You'll request a reset link by email, set a new password, and sign back in.

Prereqs​

  • You sign in with email + password. Accounts that authenticate through SSO / IAP have no local password to reset — sign in through your identity provider instead, or ask a super admin to check how your account is provisioned (Configure SSO).
  • The deployment can send mail. Self-service reset emails only deliver when the operator has configured SMTP and PUBLIC_BASE_URL (see Configuration → SMTP). On a deployment without those set, the "Forgot password?" flow completes without error but no email arrives — contact your operator to reset the account another way.

Steps​

  1. On the login page, click "Forgot password?" (below the password field). This opens /forgot-password.
  2. Enter your account email and submit. You always see the same confirmation — "If that email has an account, we've sent a reset link" — whether or not the address is registered. This is deliberate: the page never reveals whether an account exists.
  3. Open the email and click the reset link. It lands you on /reset-password?token=…. The link is single-use and expires after PASSWORD_RESET_EXPIRY_MINUTES (default 60) — request a fresh one if it's been longer.
  4. Choose a new password (at least 8 characters) and submit.
  5. Sign in with your new password.

Verify​

  • After setting the new password you're returned to the login page and can sign in with it.
  • Any other sessions are signed out. Setting a new password revokes every existing session, so a browser you were still logged in on elsewhere is bumped to the login page on its next request — sign back in there with the new password.
  • Requesting a second reset link invalidates the first: an old link (or one older than the expiry window) shows "This reset link is invalid or has expired" and asks you to start over.

Notes​

  • No email arrived? Either the address has no account, or the deployment isn't configured to send reset mail (SMTP + PUBLIC_BASE_URL, above). The forgot-password page can't tell you which — by design. If you're sure the account exists, ask your operator to check the SMTP configuration or to reset the password directly.
  • SSO / IAP users: there is no local password to reset. Requesting a link for such an account completes silently and sends nothing — sign in through your identity provider.
  • The forgot / reset endpoints are rate-limited (AUTH_PASSWORD_RESET_RATE_LIMIT_PER_MINUTE, default 5 per minute); repeated rapid attempts return 429 Too Many Requests — wait a minute and retry. Operators: both endpoints are documented under API reference → Password reset.