Email a new six-digit one-time password (OTP) for a forgotten password, a password change, or a self-service signup. The code expires after 5 minutes. The response is the same whether or not the email address is registered.

Prerequisites — the email address of an existing user (forgot_password, change_password) or of a signup in progress (rs_signup).

Authentication — Public (no token). A code is sent only when the address qualifies, and not once it has received 10 codes in the last hour; the response doesn't change. Only the most recent code can be verified.

Rate limit — 3 requests per 3 minutes, counted per client IP address. All rate-limited endpoints share the same per-IP total. Throttled responses carry X-RateLimit-Limit and X-RateLimit-Remaining; a 429 adds Retry-After and X-RateLimit-Reset and returns {"message": "Too Many Attempts."}.