Account recovery
The fallback paths that let someone regain an account after losing a password, phone, passkey, inbox, or other login proof.
What it is
Account recovery is the set of paths for regaining access after the normal proof is gone: a forgotten password, lost authenticator, missing security key, dead inbox, or disabled identity-provider account. It is broader than password reset because the lost thing may be the second factor or the external account itself.
Design it with several rungs. Start with a recovery code or another registered passkey, then a verified recovery channel, and reserve manual review for cases where the automated proofs are exhausted. Apple ships the consumer version of that ladder: a recovery key, plus a recovery contact who can vouch for you. Enterprise accounts can also use a verified organization administrator to restore membership or reset factors under a recorded policy.
The gotcha is that recovery becomes the easiest login path attackers can find. Security questions, public profile facts, and a support agent's intuition are weak proof. Apply delays to risky changes, notify every existing channel, offer a cancellation path, rate limit attempts, record the decision, and revoke old sessions and factors after a successful recovery.
Ask AI for it
Build account recovery as three ordered paths: a valid single-use recovery code, another registered WebAuthn passkey verified with `@simplewebauthn/server`, then a delayed email fallback. For the email path, send a one-time link that expires in 30 minutes, require a 24-hour hold before replacing MFA factors, and immediately notify all existing email addresses and signed-in sessions with a cancellation action. Rate limit starts and submissions by account and IP, use the same public response for existing and missing accounts, and write an audit record for every step. On success, revoke every session, refresh token, recovery code, and old MFA factor, then require enrollment of a new factor before issuing a full session.