Scroll
ProductPricingStart for free
EvoraDocs
Get started
C++ SDK
REST API
Manage
Endpoint reference
All endpoints
GETPlan quota and current usage
GETList applicationsPOSTCreate an applicationGETGet an applicationPUTUpdate an applicationDELETEDelete an application
GETApplication statisticsGETExtended overviewGETLogin activity by dayGETUser growth over timeGETLicense status breakdownGETSession trends
GETList licensesPOSTGenerate licensesGETGet a licensePUTUpdate a licenseDELETEDelete a licensePOSTBan a licensePOSTUnban a licensePOSTReset a license HWIDPOSTFreeze a licensePOSTResume a frozen licensePOSTAdjust license expiry by a signed deltaPOSTBulk license actions
GETLook up a customer by usernameGETList customersPOSTCreate a customerGETGet a customerPUTUpdate a customerDELETEDelete a customerPOSTMint a password-reset tokenPOSTConsume a reset token and set the new passwordPOSTBan a customerPOSTUnban a customerPOSTReset a customer's HWIDGETRead a customer's two-factor stateDELETEReset a customer's two-factor authenticationPOSTReset a customer's device bindingPOSTMint a one-time SDK login token (panel SSO)POSTRedeem a license key on a customer's behalfPOSTBulk customer actions
POSTAuthenticate a customer by license keyPOSTAuthenticate a customer by username and password
GETList a customer's subscriptionsPOSTGrant a subscription directlyDELETERemove a subscriptionPOSTFreeze a subscriptionPOSTResume a frozen subscriptionPOSTExtend a subscription by days
GETList tiersPOSTCreate a tierPUTUpdate a tierDELETEDelete a tier
GETList app variablesPOSTCreate or update a variableDELETEDelete all app variablesGETGet a variablePUTUpdate a variableDELETEDelete a variableGETList every user variable in the applicationGETList one customer's variablesPOSTSet a customer variableDELETEDelete all of a customer's variablesDELETEDelete a customer variable
GETList webhooksPOSTCreate a webhookGETGet a webhookPUTUpdate a webhookDELETEDelete a webhookPOSTFire a test deliveryGETRead the event stream (catch-up)
GETList blacklist entriesPOSTAdd a blacklist entryDELETERemove a blacklist entryGETList whitelist entriesPOSTAdd a whitelist entryDELETERemove a whitelist entry
GETList live sessionsDELETEKill a sessionPOSTKill every live session
GETList logsGETLog statistics
GETList sellersPOSTCreate a sellerGETGet a sellerPUTUpdate a sellerDELETEDelete a sellerPOSTAdd seller balance
GETList clientsPOSTCreate a clientPUTUpdate a clientDELETEDelete a clientGETList a client's application accessPOSTGrant application accessDELETERevoke application access
GETList entitlementsPOSTCreate an entitlementPUTUpdate an entitlementDELETEDelete an entitlementGETList entitlements attached to a tierPOSTAttach an entitlement to a tierGETResolve a customer's entitlements
GETList geo rulesPOSTAdd a geo ruleDELETERemove a geo rulePUTEnable or disable geo restrictions
GETList active leasesDELETERevoke a leaseGETSeat usage for a customer
Docs/API reference/Users

Mint a password-reset token

POSThttps://api.evora.cx/api/developer-api/users/{userId}/password-reset
Requires scopeusers:write

Evora issues and verifies; you deliver. No email is sent from our side — your customers are yours, and most have no address on file. Send the returned token over whatever channel you already use (a Discord DM, your own mail provider, a link on your panel), then call /password-reset/fulfil.

The plaintext token is returned once and is not retrievable again; only a SHA-256 hash is stored.

Because you identify the customer by userId rather than from an email form, this endpoint is not a user-enumeration oracle. Preserve that property in your own panel by responding identically whether or not an account exists.

Path parameters
userIdrequired
string (uuid)
End-user UUID.
Body
appId
string (uuid)
Recorded for audit.
ttlSeconds
integer
Default: 1800 · Range: 300–86400
Request
{
  "ttlSeconds": 1800
}
Responses
201Token minted.
json
{
  "success": true,
  "reset_token": "s7Fv3k9Qx1...",
  "expires_at": "2026-08-06T18:30:00.000Z",
  "expires_in": 1800,
  "warning": "Deliver this token to the user now — it is not retrievable again."
}
403The customer is banned.
429Too many live tokens for this customer (max 3), or issuance rate exceeded.
json
{
  "error": "Too many active reset tokens for this user.",
  "code": "RESET_RATE_LIMITED"
}

More in Users

  • GETLook up a customer by username
  • GETList customers
  • POSTCreate a customer
  • GETGet a customer
  • PUTUpdate a customer
  • DELETEDelete a customer
  • POSTConsume a reset token and set the new password
  • POSTBan a customer
  • POSTUnban a customer
  • POSTReset a customer's HWID
  • GETRead a customer's two-factor state
  • DELETEReset a customer's two-factor authentication
  • POSTReset a customer's device binding
  • POSTMint a one-time SDK login token (panel SSO)
  • POSTRedeem a license key on a customer's behalf
  • POSTBulk customer actions

Base URL https://api.evora.cx/api/developer-api · full spec at developer-api.yaml · back to the docs