Branded Password Reset Email
When a staff user clicks Forgot password? on your sign-in page, concorbit sends a reset email through the same template engine, brand kit, and SMTP routing as every other email your workspace sends. There is nothing to switch on. It works automatically the moment your workspace has a brand identity and an SMTP provider configured.
What your users see
The reset email arrives:
From your brand: the From-name and From-address come from your brand identity (Settings > Brand > Identity). If you have not set a custom
default_from_email, the email sends from your tenant's name + your platform default address.In your colours: the email uses your accent colour for the hero band and call-to-action button. Your logo (if uploaded) is rendered at the top of the email.
From your domain: the reset link in the email points back to the same host the user used to request it. If they were on
app.your-company.com, the link ishttps://app.your-company.com/reset-password/.... If they were onyour-slug.concorbit.com, the link uses that. Users never get bounced to a different domain in the middle of the reset flow.Through your SMTP provider: deliverability follows your configured SMTP settings, including SPF / DKIM / DMARC alignment for your sending domain. The send appears in your Email > Logs alongside every other transactional email.
Editing the template
You can fully customise the email layout, copy, and design.
Go to Email > Templates.
Find Password reset (staff) in the System emails section.
Click to open the visual editor.
Make your changes: change the heading, swap the button copy, add a paragraph above the CTA, change the footer.
Save.
concorbit creates a workspace-specific override the moment you save. The platform default is preserved, so you can revert to it any time by deleting your override.
Available merge fields
When editing the template, you can use these merge fields anywhere {{ field_name }} appears:
| Field | Substituted with |
|---|---|
| {{ tenant_name }} | Your workspace name |
| {{ recipient_name }} | The user's first name (falls back to "there" if their name is unset) |
| {{ reset_url }} | The unique single-use reset link |
| {{ expires_in }} | Human-readable expiry (e.g. "1 hour") |
The {{ reset_url }} field is bound to the Reset password button by default, so most workspaces won't need to change it. If you want to render it as a fallback text link below the button (some email clients strip styled buttons), add a Text block with If the button doesn't work, copy this link: {{ reset_url }}.
Security notes
Reset URL host is validated. The host the email links to is matched against your active tenant domains, your subdomain on
concorbit.com, or the platform host. A spoofedHost:header on the inbound request can't redirect the email to an attacker-controlled domain. concorbit falls back to the platform URL if the host isn't recognised.Email enumeration is mitigated. The "If an account with that email exists, we sent a reset link" response is shown for every submission, even when no account matches. Attackers can't tell from the response whether the email is in your workspace.
Token is single-use. Each reset link is valid for 60 minutes and works exactly once. After it's used, it's consumed; if it expires unused, the user has to request a new one.
Reset doesn't bypass MFA. A user who has MFA enabled still has to complete the MFA challenge after they reset their password.
What happens on the platform host
If a user requests a reset on concorbit.com (the platform sign-in page) instead of your branded host, the email still goes through your workspace's SMTP and brand, because the email follows the user's identity, not the host. The reset link in that case points back to concorbit.com/reset-password/....