Título sugerido: Identity password recovery fails intermittently — 502 from gotrue, widget shows "User not found"

Support
1

Hi,

I’m having a persistent problem with Netlify Identity password recovery on my site.

Site: detrasdelobjetivo2.netlify.app

What happens

When a user clicks “Forgot your password?”, the recovery email is sent and received correctly. But when they open the link from the email, the password reset always fails — even when the link is opened within seconds of receiving it.

What I’ve already verified myself

I have custom UI for the recovery flow (not the default widget modal), so I was able to surface the raw error returned by the Identity endpoint instead of a generic message. Over several attempts, I captured three different real responses:

  1. HTTP 502 with this body:
   Error: Server Error
   The server encountered a temporary error and could not complete your request.
   Please try again in 30 seconds.
  1. “Rate limit exceeded, try again later” — after several recovery requests while testing.
  2. “User not found” — even though the account definitely exists (I can see it listed under Identity in my Netlify dashboard).

I believe (3) is actually a symptom of (1): the widget seems to render “User not found” when gotrue returns a 502 before the request reaches it. This matches the report in this thread: Identity (gotrue) /token returns 502 Bad Gateway intermittently to my clients only — healthy from server-side probes

What my code does

My implementation captures recovery_token from the URL hash before the Identity widget script loads (to avoid a double-consumption race), then calls gotrue.recover(token, true) exactly once, and on success calls user.update({ password }). The user is derived solely from the verified token — no email or user ID is taken from the client side.

The account exists, the token is passed through intact, and the call is made only once. The failure appears to happen server-side before my code can complete the exchange.

What I’ve already tried

  • Confirmed the user account exists in the Identity dashboard.
  • Confirmed the recovery email arrives promptly with a valid-looking link.
  • Opened the link immediately after receiving it (within ~30 seconds).
  • Tested on both mobile (Android/Chrome) and desktop.
  • Verified my code is not consuming the token twice.

What I’d like help with

Could you check the gotrue logs for my site to see why the recovery/verify requests are returning 502? Happy to provide a HAR file if that helps.

Thanks!

detrasdelobjetivo2.netlify.app