OpenGenesisLINKWorld API password recovery – security

World API password recovery – security

World API password recovery via MariaDB one-time tokens, scoped permissions, expiry and staged rollout.

Updated 2026-10-25

New P0 recovery protocol in development source

The World API provides a separate password recovery protocol for the town portal. Only authenticated server-side services can issue and consume World password recovery challenges; arbitrary supplied account IDs cannot authorize password changes.

Backend-only routes

POST /api/v1/auth/password-recovery/challenges
POST /api/v1/auth/password-recovery/complete

Machine scopes password-recovery:issue and password-recovery:complete are separate. The World resolves and verifies the actual account email; the portal must deliver only to that address. Random one-time tokens expire after 900 seconds. Token hashes, account mapping and claim status persist in the existing ROBUST MariaDB ogl_password_recovery InnoDB table, not in a separate SQLite store. Replay and concurrent claims are guarded.

Staging configuration

[NexVerseWorldApi]
EnablePrivilegedEndpoints = true
PasswordRecoveryEnabled = true

Disabled by default. Portal migration, email delivery, real Firestorm login after reset, old-password rejection, TLS, permissions, backup and rollback require validation. Old portal reset tokens cannot be treated as World challenges.

MariaDB is a requirement of this recovery implementation, not a claim that all OpenGenesisLINK database backends are MariaDB-only.

Back to main page Roadmap