Self-Service Password Reset and Magic Link Sign-In
Users can reset a forgotten password themselves, or sign in with a one-time link sent to their email, without contacting an administrator. The two features are separate switches and can be used independently.
Default behavior
On a self-hosted server both features are off by default. The sign-in page shows no "Forgot password?" or "Email me a sign-in link" option until you turn them on.
Before you begin
Both features send email and build links back to your server, so two things must be in place:
Requirement | Where | Why |
|---|---|---|
Outgoing email (SMTP) configured and tested | Reset and sign-in links are delivered by email | |
Public URL set | Settings → Server Settings → Security Settings | The address users reach Yurbi at, used to build the links |
Public URL is the address your users type to reach Yurbi, for example https://reports.example.com. If Yurbi is installed in a sub-folder, include it: https://www.example.com/yurbi. If you use a custom login page, enter its full address including the file name, for example https://www.example.com/login.html.
The page will not let you turn on either switch until Public URL is filled in. If outgoing email is not configured, the page shows an amber Email is not set up warning: the links still appear on the sign-in page, but no email can be sent until you configure a mail server under Settings → Scheduler → Mail Settings.
Warning: If Public URL is wrong, emailed links will not open the sign-in page. Set it and send yourself a test reset before enabling for users.
What the emails look like. Reset, sign-in-link, welcome and two-factor emails all share one layout. The name shown in the subject and body comes from Product name under Settings → Server Settings, so set that to the name your users know — it defaults to "Yurbi".
Turning the features on
Go to Settings → Server Settings → Security Settings and scroll to Self-Service Account Recovery.
Enter the Public URL of this site.
Turn on Allow users to reset a forgotten password by email and/or Allow users to request a one-time sign-in link by email.
Click Save.
The links appear on the sign-in page immediately.
What users see
Forgot password
The user clicks Forgot password? on the sign-in page and enters their username or email address.
They see a message that if the account exists, an email has been sent. The message is the same for every entry, so it does not reveal whether an account exists.
The email contains a reset link that works once and expires in 15 minutes.
The reset page shows the masked username and email so the user can confirm it is the right account, then asks for a new password. If Enhanced Password Security is on, the rules are listed on the page and enforced.
If the user has two-factor authentication, they are asked for a code before the password is changed. Email and text codes are sent automatically; Try another way offers any other method they have set up, and Use a backup code accepts a backup code.
A confirmation email is sent after the change.
Magic link sign-in
The user clicks Email me a sign-in link and enters their username or email address.
The email contains a link that signs them in directly. It works once and expires in 15 minutes.
Two-factor authentication still applies after the link is used.
A notice email is sent each time a sign-in link is used.
Who can use these features
User type | Password reset | Magic link |
|---|---|---|
Username and password | Yes | Yes |
SSO with a local password | Yes | Yes |
SSO, Windows, or external identity only (no local password) | No | No |
Disabled users | No | No |
Users who cannot use the feature still see the generic "email sent" message; no email is sent.
Administrator-sent links. Administrators can send a reset link (or a welcome link for new users) from the user editor even when these switches are off — see Managing User Accounts.
Shared email addresses. If several accounts share one email address, the user must enter their username rather than the email so the right account is reset.
Limits
Limit | Value |
|---|---|
Link lifetime | 15 minutes, single use |
Requests | 3 per hour per account |
Attempts to open a link | 10 per 15 minutes |
An unused link stays valid until it expires. Completing a reset invalidates every other outstanding link for that account.
Troubleshooting
The user did not receive the email. Check the Audit Log for a Password Reset Requested or Magic Link Requested entry. If there is none, the account was not eligible (no local password, disabled, or a shared email address). If there is an entry but it notes that the email could not be sent, check your outgoing mail settings. Otherwise check spam folders.
The link opens a blank page or an error page. Public URL is wrong. Compare it with the address in the browser when you are signed in, including any sub-folder.
"This link is invalid or has expired." The link is older than 15 minutes, was already used, or a reset was completed with a different link. Ask the user to request a new one.
The user reset the wrong account. The email address is shared by more than one account. Have the user request the reset with their username.
"Too many requests." The account or address has hit the limit above. Wait, or have an administrator send a link from the user editor, which is not subject to the self-service limit.
Turning the features off
Turn off either switch and save. Outstanding links of that type stop working immediately.
Frequently asked questions
Can I change the wording of the emails or the reset page? The welcome email subject and message are editable under Security Settings → Welcome email. The reset and sign-in link emails are not editable; they use the Product name from Settings → Server Settings and the same layout as scheduled-report emails.
Does magic link replace passwords? No. It is a convenience for users who have a password. It does not work for SSO-only or external users.
Is this recorded? Yes. Requests, completed resets, and link sign-ins appear in Settings → Audit Log with the user and time.