• Sign-in and security has a password card: change your password with the current one, or add one to an account that signs in without. Every other device is signed out, the re-verify dialog opens first when an authenticator or passkey is enrolled, and a wrong current password or a weak new one is said on its own field.
• The sign-in page has "Forgot your password?": it emails a link to the address typed above, which signs the person in and opens Sign-in and security at a "Choose a new password" card that does not ask for the old one. If the link was opened too long ago to stand in for the old password, the card asks for it after all and says why.
• A sign-in link can be asked for as a password reset: POST /auth/login/start with grant_type: 'link' takes purpose: 'reset', which emails "Reset your password" instead of "Sign in" and lands the person on the password form once the link has signed them in. The limit on how often an address can be mailed, and the answer for an address with no account, are the sign-in link's own.
• PUT /auth/password sets or changes the signed-in person's own password (sdk.authentication.factors.setPassword). It needs the current password when there is one, unless a sign-in link was used in the last ten minutes, and a recent authenticator or passkey once one is enrolled. Every other session of the account is signed out, and each of its email addresses gets a notice that the password changed.