---
title: "Verify a password reset changes the usable credential"
description: "Reset a disposable account password from a test inbox and prove that the new credential works while the former password is rejected after sign-out."
canonical_url: "https://vostride.com/agent-library/account-recovery/reset-password-happy-path.md"
md_url: "https://vostride.com/agent-library/account-recovery/reset-password-happy-path.md"
content_kind: "recipe"
topic: "account-recovery"
---

# Verify a password reset changes the usable credential

Reset a disposable account password from a test inbox and prove that the new credential works while the former password is rejected after sign-out.

## Risk

A reset confirmation page can appear before the credential update has persisted. The decisive evidence is a fresh login using the new password together with rejection of the old password, tied to the same account identity.

## Fixtures

- A verified test-owned account with a known original password held in secrets.
- A dedicated test inbox and a unique replacement password provided through a separate secret reference.
- An account inspection hook and a documented policy for sessions active before the password reset.

## Steps

1. Request a password reset for the fixture email and verify the application provides its expected generic delivery response.
2. Retrieve the run-specific reset message and open its link; verify the password form appears without exposing the token in recorded notes.
3. Enter the replacement password twice, submit once, and verify the application reports completion rather than a validation error.
4. Sign out if the reset signed the account in, then attempt login with the original password and verify rejection.
5. Sign in with the replacement password, verify the correct account identity, and use the account hook to confirm the reset event and preexisting-session handling match policy.

## Expected results

- The replacement password grants a fresh authenticated session for the intended account.
- The former password no longer authenticates after the completed reset.
- Account metadata shows one completed reset and the documented treatment of earlier sessions.

## False-pass traps

- A password-strength indicator describes local validation and does not prove the reset was saved.
- A browser already authenticated before reset can make an unchanged password look successful.

## Cleanup

- Restore the disposable account through the fixture mechanism and remove its run-specific reset messages.

## Use with agent-qa

Adapt this test design to your application's acceptance criteria and configured target using the [recipe execution guide](/agent-library/software-factory/turn-a-recipe-into-an-agent-qa-test.md). External fixture setup and non-UI checks require your own supported hooks or test tooling. Validate the authored test, execute it, and inspect the completed evidence; this recipe is not a recorded test result.

## References

- [agent-qa test](/docs/agent-qa/configuration/test.md)
- [agent-qa hooks](/docs/agent-qa/guides/hooks.md)
- [agent-qa auth state](/docs/agent-qa/guides/auth-state.md)

- [Account recovery QA recipes](/agent-library/account-recovery.md)
- [Software factory QA library](/agent-library.md)