Password reset uses Laravel's built-in password broker under the hood. Two endpoints handle the flow, neither requires authentication.
The client collects the user's email and sends it to POST /auth/forgot-password. The API always returns a 200 with a generic message regardless of whether the email exists. This prevents user enumeration.
If the email is registered, Laravel sends a reset notification with a link pointing to your frontend app. The link includes a token and email as query params, something like your-frontend.com/reset-password?token=abc123&email=user%40example.com.
The client extracts those values, collects the new password, and sends everything to POST /auth/reset-password. On success, all existing Sanctum tokens for that user are revoked, forcing a fresh login everywhere.
The reset email link points to whatever FRONTEND_URL is set to in your .env. This is separate from APP_URL, which is the API's own address. The config lives at config('app.frontend_url') and the URL is assembled in AppServiceProvider::boot() via ResetPassword::createUrlUsing().
Reset tokens expire after 60 minutes by default. This is controlled by config('auth.passwords.users.expire') in config/auth.php. The password_reset_tokens table stores the hashed token and cleans up automatically when a reset completes.
Laravel throttles reset link requests per email. If a user requests a link too soon after the previous one, the broker returns a throttle status. The default cooldown is 60 seconds, configurable via config('auth.passwords.users.throttle').