Password and email verification
How password reset by email works, the email-verification banner and resend, what an unverified account can and can't do, and which accounts are grandfathered.
MentionFlow handles two account-email flows itself: resetting a forgotten password, and verifying your email address. Both send from the workspace's configured sending domain — there is no fallback sender, so a link that reaches your inbox always points at the real app.
Resetting your password
If you can't sign in, use Forgot password? on the sign-in page. Enter your account email and MentionFlow sends a link to set a new one.
- The response is the same whether or not an account exists for that address, so it never confirms who has an account. The page reads: "If an account exists for
<email>, a reset link is on its way." - The link works once and expires in 60 minutes. A used, expired, or invalid link lands on a "This link doesn't work anymore" page with a button to request a fresh one.
- A new password must be at least 8 characters.
- Setting a new password signs out your other sessions everywhere — a precaution in case the old password had leaked.
Password reset needs outbound email configured on the install. If it isn't, the Forgot password page says so up front ("Password reset by email isn't available right now") rather than showing a form that can't deliver.
Verifying your email
New accounts are asked to confirm their email address. The verification link expires in 24 hours; opening it confirms the address, signs you in, and lands on an "Email verified" confirmation. An expired or invalid link explains why and points you back to the resend banner.
The verification banner
Until a post-cutoff account is verified, a banner sits at the top of the dashboard:
Verify your email — we sent a link to
<your address>. Until it's verified, actions that send data out of MentionFlow (API keys, report schedules, webhooks) are locked.
- Resend re-sends the link to your own address. It can only ever send to the account you're signed in as, and it's rate-limited to 3 sends per minute (the button shows a 60-second cooldown).
- A failed send stays visible and retryable — a dead email service never reads as "sent".
- During operator support view, the banner reflects the operator's own account, never a viewed customer's — view-as can't surface or trigger another user's verification flow.
What an unverified account can't do
Verification is a soft gate, not a sign-in wall. Signing in, onboarding, monitors, and the rest of the dashboard all work while unverified. What's held are the three actions that send workspace data out of MentionFlow — because those send from the verified domain or push data to an external endpoint:
| Action | Unverified | Why it's gated |
|---|---|---|
| Create an API key | Blocked | A key reads workspace data programmatically. |
| Enable a scheduled report | Blocked | An enabled schedule emails a client report to external recipients. |
| Set or test-fire a notification webhook | Blocked | A webhook POSTs brand data to an arbitrary endpoint. |
| Everything else (sign-in, monitors, prompts, dashboard) | Allowed | No data leaves MentionFlow. |
Actions that only reduce egress always stay open even while unverified — pausing a schedule, clearing a webhook, revoking a key. A blocked action returns a plain message telling you to verify first.
Grandfathered accounts
Every account created before 2026-07-11 predates email verification and is exempt: it never sees the banner and none of the gates above ever apply to it. Nothing an existing account could do the day before is taken away. These accounts keep an unverified status in the data — MentionFlow never marks an address verified that it didn't actually verify.
Limits
- Reset links: single-use, 60-minute expiry.
- Verification links: 24-hour expiry.
- Reset requests and verification resends are rate-limited to 3 per minute.
- The three egress actions above require a verified email for accounts created on or after 2026-07-11; older accounts are grandfathered.
- Both flows require outbound email to be configured on the install; when it isn't, the flows say so instead of silently failing.
Related
- Two-factor authentication — add a second factor to sign-in.
- Workspace and members — roles, invites, and the audit log.
- API keys — the keys whose creation the verification gate covers.
- Reports — scheduled reports, the other gated egress action.