Classic account recovery is a chain: an email with a link, a click, a new-password form,
sometimes an SMS code on top. Every link breaks — the email lands in spam, the mailbox is
unreachable, the number has changed.
When a user has a linked trusted channel, recovery becomes the same action as signing in: a
confirmation in a messaging app where they are already authenticated.
How it works
Recovery uses an ordinary sign-in. The user signs in via the linked channel, you recognize them
by sub (or by the stored channel_type + channel_user_id pair) and grant access to the
account.
What follows is your decision: let them straight in, offer to set a new password, or require a
second confirmation in another channel if the operation warrants it — see
step-up.
What has to be in place first
The channel must be linked before access needs recovering. The convenient moment is the
sign-in itself: one action gives you both authentication and the link — see
sign-in and channel linking.
What to keep in mind
Recovery is exactly as trustworthy as the channel behind it. The link lives on your side, and
so does the decision that this channel suffices to hand an account back. For high-privilege
accounts, requiring confirmation in two different channels is the sounder default.
- You keep the accounts. Veriqa confirms an identity in a channel; finding the account by
sub and restoring access to it is up to your application.
- Passwords stay on your side: Veriqa does not store them and takes no part in changing them. If
you offer to set a new password after the sign-in, the form and the checks are yours.
- The policy is yours: Veriqa does not decide for you whether one confirmation is enough.
