Password and MPIN resets follow a deliberate three-step flow: Trigger Reset, Validate Session, Apply Reset. The reset session is short-lived and rate-limited — do not expect a single call to complete the credential change, and never skip a step.
Overview
The same three-step shape applies to both password resets (the account-wide credential) and MPIN resets (a per-device PIN distinct from the account password). First, Trigger Reset starts the process by creating a short-lived reset session and sending the user a reset link or MFA challenge. Second, Validate Session confirms the reset session is still active before the user is shown a form to enter a new credential. Third, Apply Reset sets the new password or MPIN and deletes the reset session — preventing the link from being reused. All three steps must complete while the reset session is still valid; if the user delays beyond the session's lifetime, they must request a new reset from the beginning.
Operations
Trigger Reset
Initiates the reset flow for either a password or an MPIN. Creates a short-lived reset session and sends the user a reset link or MFA challenge, depending on the provider's configuration. The reset session ID returned here is required by the Validate and Apply steps.
Validate Session
Confirms the reset session is still valid before presenting the user with a form to enter a new credential. Call this immediately before showing the reset form. If the session has expired, validation fails and the user must re-trigger the reset.
Apply Reset
Sets the new password or MPIN and deletes the short-lived reset session. After this step the reset link or token cannot be reused — the session is gone. A successful Apply Reset completes the flow; the user can then sign in with the new credential.
Guardrails
Two constraints govern reset flows:
Short session lifetime — the reset session expires quickly (a few minutes). Design the flow so users move through all three steps promptly. Communicate the time limit clearly in the reset UI.
Rate limiting — resets are rate-limited to approximately five attempts per user per 24 hours. If a user exhausts their attempts (for example, by requesting multiple reset links), the flow will be blocked until the window resets. Inform users so they are not surprised.
Do not skip the Validate step. It is a security check that confirms the session hasn't expired or been tampered with. Skipping it risks applying a reset to a stale or invalid context.
Notes
Keep the following in mind when building reset flows.
The same three-step shape — Trigger, Validate, Apply — applies to both password and MPIN resets.
MPIN is a per-device PIN; password is the account-wide credential. Specify the correct type in the Trigger step.
The reset session expires quickly. If the user delays past expiry, they must request a new reset from Trigger.
Resets are rate-limited to approximately five attempts per user per 24 hours.
Apply Reset deletes the reset session on completion — the reset link is one-time use.
Do not attempt to skip Validate; it is a required security check before Apply.
Communicate the session's short lifetime clearly to users in the reset UI. If they leave the page and return after the session expires, they will need to request a new reset link rather than resuming where they left off.