# Reset your password

Requesting a reset link, setting a new password, and what happens when the link has been used

Section: app. Audience: public. Updated: 2026-09-23.

---
Password reset happens on one address, `/reset-password`, and that address does two different jobs depending on whether you arrived with a link.

## Asking for a link

From the sign-in screen, choose **"Forgot password?"**. You are taken to a recover-account form that asks for your email address.

Submitting it always gives you the same reassuring answer, whether or not an account exists for that address. That is deliberate: a reset form that told you which addresses were registered would be a way of finding out who has an account.

If an account does exist, a link arrives by email.

## Setting the new password

The link opens the same address, this time carrying a token, and the form asks for a new password. Press **"Save new password"**.

Once the password is changed, the link is spent. The form is removed and a single way forward remains: a **"Sign in"** button. There is nothing left to submit, so nothing invites you to try.

That is true whether or not your account has a second factor. An account with a second factor is not signed in by the reset; it is sent to sign in properly, where the code will be asked for.

Changing the password this way also signs out every session the account had open, on every device. The link reached your inbox, so it proves the address is yours, and the address counts as confirmed from then on.

If this is the first time the address is confirmed, the reset also switches off the account's API keys and removes any Google or Microsoft sign-in linked to it, because they may have been set up by someone else before you. You get an email saying what was removed, and how many team members, webhooks and connected Shopify stores to check in Settings. Those, and an authenticator app, are left as they are for you to review. An address that was already confirmed, for example through the link in the email sent when the account was created, keeps its API keys.

## If you signed in with Google or Microsoft

An account created through a provider starts without a password. The same link sets one, so you can sign in either way afterwards.

If Google or Microsoft sign-in told you an account already exists for your address and to reset its password first, this is the way through: reset the password, then continue with the provider.

## A note on the address

The reset screen is shown for anyone who opens that address, including someone who is already signed in. If you land on it by accident, go back to the app's own address and you will be returned to where you were.