Forgot password

If you've forgotten your password, Plugipay can issue a reset link via email. The link sends you to Huudis to set a new password, then back to Plugipay to sign in.

The whole flow takes about a minute.

When to use this

Use Forgot password if:

You signed up with email + password and don't remember the password.
A password manager autofilled the wrong password and now the right one isn't loading.
You've been locked out by too many failed sign-in attempts (this bypasses the lockout).

If you signed up with Google or Apple, you don't have a Plugipay password to reset. Sign in via the same social provider you used to sign up — the Sign in page has the button. If you've forgotten which provider, try them all; the wrong ones will say "no account."

The flow

Click "Forgot password?" on the sign-in screen.
Enter your email. We send a reset link.
Click the link in your inbox.
Set a new password.
Sign in with the new password.

Step-by-step

1. Click Forgot password

On plugipay.com/signin, scroll to the email/password form and click Forgot your password? below the password field.

You're now on plugipay.com/forgot-password. The page shows a single email field.

2. Enter your email

Enter the email you used at sign-up. Click Send reset link.

Plugipay tells Huudis to send a reset email regardless of whether the email exists in our system. This is intentional — we don't want to confirm or deny account existence by responding differently.

What you'll see:

If you@example.com has a Huudis account, we sent a reset link. It expires in 1 hour.

If the email isn't on file, no email gets sent. If it is, you'll get one within a minute.

3. Click the link

Check your inbox for an email from no-reply@huudis.com. Subject: "Reset your Forjio password."

Click the link. It opens plugipay.com/reset-password?token=….

The link expires in one hour. If you wait too long, request a new one. We deliberately short-window reset links because they're sensitive — a long-lived link in your inbox is a phishing target.

4. Set a new password

The reset page shows two fields:

New password — minimum 10 characters. Same rules as sign-up.
Confirm new password — type it again.

Click Update password.

The page updates your password on Huudis. Your old password stops working immediately.

5. Sign in

The reset page redirects to plugipay.com/signin with a banner: "Password updated. Sign in to continue."

If you had any open Plugipay sessions in other browsers or tabs, they'll keep working until they expire naturally (up to 30 days of inactivity). To sign out everywhere immediately, see Sign out → Sign out of all sessions.

What if you don't receive the email?

The reset email comes from no-reply@huudis.com. Things to try:

Check spam/junk. Many corporate filters quarantine first-time senders.
Check the right inbox. If you have multiple emails, sign-up may have been with a different one.
Wait 5 minutes. Most arrive within seconds, but rare delivery delays happen.
Whitelist @huudis.com. Your IT team can do this.
Try a different email. If you also have a Google or Apple sign-in linked, use that and add a password from inside the dashboard.

If after all that you still can't receive email, contact hello@plugipay.com from the same email address. We can verify you and reset manually.

What if you no longer have access to the email?

This is harder. The email address is the durable identity — if you've lost it permanently, you've effectively lost the account.

Options:

Change the email first. If you can sign in (via Google/Apple), go to Settings → Security → Change email before you lose access to the current one.
Recovery contact. Workspace admins can invite a new user to replace you. If you're the only admin and you've lost the only email, contact hello@plugipay.com with as much proof of identity as you can provide. We'll work with you but can't guarantee recovery.

This is why we recommend signing up with an email you control long-term — not a work email at a job you might leave.

Multi-factor authentication and password reset

If you have MFA enabled, resetting your password does not disable MFA. The next sign-in will still ask for your TOTP code or WebAuthn key.

If you've also lost your MFA factor:

Use a backup code (one of the codes you saved at MFA enrollment).
Or ask a workspace admin to disable MFA on your account.
Or, if you're the only admin, contact hello@plugipay.com.

We strongly recommend printing or storing backup codes when you enable MFA.

Programmatic reset

For automation — e.g., self-service flows in an embedded admin product — the password reset request endpoint is public:

curl -X POST https://plugipay.com/api/v1/auth/password-reset/request \
  -H "Content-Type: application/json" \
  -d '{"email": "alice@example.com"}'

The response is always 200 {"ok": true}, even if the email doesn't exist. This is intentional (no enumeration).

The complete endpoint (/api/v1/auth/password-reset/complete) takes a token and a new password:

curl -X POST https://plugipay.com/api/v1/auth/password-reset/complete \
  -H "Content-Type: application/json" \
  -d '{"token": "...", "password": "new-secure-password"}'

Both endpoints proxy to Huudis behind the scenes; the same flow used by the dashboard.

Common errors

"Reset link expired"

The link is older than one hour. Request a new one.

"Reset link invalid"

The token has been used already, or someone has modified the URL. Request a new link.

"Password too short"

Minimum 10 characters. Same as sign-up.

"Password the same as before"

Huudis doesn't allow reusing the previous password. Pick something different.

Sign in — sign in with your new password.
Authentication overview — the protocol-level picture.
Sign out — how to end sessions.