Email and account security
These endpoints handle email verification and password recovery. Within /api/email/*, only the resend endpoint requires authentication.
Email verification
POST /api/email/verify
Verifies an email address using the token from the verification message. Tokens are single-use and valid for 24 hours.
| Parameter | Type | Required |
|---|---|---|
token | string | Yes |
An invalid or expired link returns 400 invalid_token. Request a new verification email.
POST /api/email/resend
Resends the verification email. Requires a session token. An already verified address returns 400 already_verified.
Password recovery
POST /api/email/forgot
Requests a password reset.
| Parameter | Type | Required |
|---|---|---|
email | string | Yes |
{ "ok": true, "message": "如果该邮箱已注册，我们已发出重置链接" }The response is identical whether or not the address is registered, preventing account enumeration. Reset tokens are valid for 30 minutes.
POST /api/email/reset
Sets a new password using a reset token.
| Parameter | Type | Required | Description |
|---|---|---|---|
token | string | Yes | Password reset token |
password | string | Yes | 8–72 characters, including letters and digits |
After a successful reset, all existing sessions are invalidated immediately. Sign in again with the new password.
Mail transport
GET /api/mail/status
Returns the active mail transport.
{ "ok": true, "transport": "smtp", "smtpConfigured": true, "baseUrl": "https://modelfold.ai" }transport | Meaning |
|---|---|
smtp | SMTP is configured; messages are delivered |
file | SMTP is not configured; messages are written to a server log file as a fallback. Users do not receive these messages |
POST /api/mail/test
Sends a test email to your own address or a specified recipient to verify SMTP configuration.
| Parameter | Type | Required |
|---|---|---|
to | string | No; defaults to your own address |
Incorrect configuration returns 400 with the specific reason in the response.