Password recovery with HMAC token

Why HMAC, not random DB token

Stateless validation, no DB lookup per token validate; HMAC verifies cryptographically. See ADR 0017.

Single-use enforcement

Even though the HMAC is stateless, single-use IS stateful, Kratos records used tokens in the recovery flow's state. Replay attack returns "token already used."

Where to learn more

• Identity, Flow recovery
• Security, Breached password
• ADR 0017, Recovery HMAC token