Hi everyone.. Am trying to implement “forgot password feature” 1. Get a recovery flow ID from self-service/recovery/browser’ 2. Submit the form to self-service/methods/link?flow=MY_ID 3. I receive an email with the following link: self-service/recovery/methods/link?token=SOME_TOKEN 4. When I click on the above link from the email am redirected to /settings?flow=FLOW_ID 5. This page shows a form to enter the new password I don’t know what to do next. What I tried is to submit to self-service/settings?flow=FLOW_ID but I get “CSRF token is missing or invalid.” .. Then I ttry to get the flow object from the FLOW_ID so i can get the correct csrf token, but I get unauthorised. What am I doing wrong? Any help/ direction is much appreciated.

the token in that email contains a temporary credential, enough to get you to the account page (called settings in Ory ecosystem) you'd need to first implement the settings page first to be able to have recovery page though if using (code) as recovery, that wouldn't be necessary cause only a single textbox for the code is required on POST to successful submit recovery flow

Thank @alert-advantage-94977, I have created a settings page, and its redirecting to it. Now what should I do?

the flow id can be used to get the settings-flow info render them for the user and show a message saying that they have temporary credentials and should submit their new password before the (configured) lifespan is expired

when trying to get the settings flow info using the flow id , I get unauthorised ..

pass in the cookies as well

@alert-advantage-94977, thank you.. you saved my day 🌸