---
title: "Verify a consumed reset link cannot reset the account again"
description: "Complete one password reset, replay the same recovery URL, and verify that a second replacement password never becomes an accepted credential."
canonical_url: "https://vostride.com/agent-library/account-recovery/reset-link-replay.md"
md_url: "https://vostride.com/agent-library/account-recovery/reset-link-replay.md"
content_kind: "recipe"
topic: "account-recovery"
---

# Verify a consumed reset link cannot reset the account again

Complete one password reset, replay the same recovery URL, and verify that a second replacement password never becomes an accepted credential.

## Risk

A reset token should stop being a credential after successful consumption when the product promises single use. Replaying it from a signed-out state distinguishes actual token reuse from navigation under an already established session.

## Fixtures

- A disposable account with original, first replacement, and attempted second replacement secrets.
- One run-specific recovery email retained by the test inbox fixture for controlled replay.
- A recovery-event inspection hook and an explicit single-use reset-token policy.

## Steps

1. Request and open the recovery message, set the first replacement password, and verify completion for the fixture account.
2. Sign out fully and reopen the exact same recovery URL; verify a used-or-invalid token response.
3. If a password form remains visible, submit the attempted second replacement and verify it is rejected rather than reported as successful.
4. Attempt a fresh login with the second replacement and verify failure; then log in with the first replacement and verify the intended account identity.
5. Inspect the recovery event record and verify one successful token consumption with no second credential update.

## Expected results

- Only the first valid consumption changes the account password.
- Replayed reset submission cannot replace the first replacement credential.
- The first replacement still authenticates after the replay attempt.

## False-pass traps

- Opening the replay link in an authenticated session can hide whether the link itself was accepted.
- A disabled form button is weak evidence unless the original credential transition and final fresh login are also checked.

## Cleanup

- Restore the disposable account credential and remove the retained recovery message.

## Use with agent-qa

Adapt this test design to your application's acceptance criteria and configured target using the [recipe execution guide](/agent-library/software-factory/turn-a-recipe-into-an-agent-qa-test.md). External fixture setup and non-UI checks require your own supported hooks or test tooling. Validate the authored test, execute it, and inspect the completed evidence; this recipe is not a recorded test result.

## References

- [agent-qa test](/docs/agent-qa/configuration/test.md)
- [agent-qa hooks](/docs/agent-qa/guides/hooks.md)
- [agent-qa auth state](/docs/agent-qa/guides/auth-state.md)

- [Account recovery QA recipes](/agent-library/account-recovery.md)
- [Software factory QA library](/agent-library.md)