- POST /v1/recover: request recovery code - POST /v1/recover/verify: verify code, receive key via email - Key sent via email only (not in API response) for security - Rate limited to 3 attempts per hour - Non-enumerable: same response whether email exists or not - DKIM-signed emails via postfix/opendkim |
||
|---|---|---|
| .. | ||
| __tests__ | ||
| middleware | ||
| routes | ||
| services | ||
| index.ts | ||