diff --git a/app/app.py b/app/app.py
index 3762c14..3659708 100644
--- a/app/app.py
+++ b/app/app.py
@@ -129,6 +129,59 @@ def require_capability(cap):
 #       AUTH
 # ================
 
+
+import smtplib
+from email.message import EmailMessage
+import uuid
+
+@app.route("/auth/forgot", methods=["POST"])
+def forgot():
+    email = request.form.get("email")
+
+    db = SessionLocal()
+    user = db.query(User).filter_by(email=email).first()
+    if not user:
+        db.close()
+        return jsonify({"status": "ok"})  # não revela nada
+
+    token = str(uuid.uuid4())
+    user.reset_token = token
+    db.commit()
+    db.close()
+
+    msg = EmailMessage()
+    msg["Subject"] = "Password reset"
+    msg["From"] = Config.SMTP_USER
+    msg["To"] = email
+    msg.set_content(f"Reset link: https://{Config.APP_DOMAIN}/auth/reset?token={token}")
+
+    with smtplib.SMTP(Config.SMTP_HOST, Config.SMTP_PORT) as s:
+        s.starttls()
+        s.login(Config.SMTP_USER, Config.SMTP_PASS)
+        s.send_message(msg)
+
+    return jsonify({"status": "ok"})
+
+
+@app.route("/auth/reset", methods=["POST"])
+def reset():
+    token = request.form.get("token")
+    new_password = request.form.get("password")
+
+    db = SessionLocal()
+    user = db.query(User).filter_by(reset_token=token).first()
+    if not user:
+        db.close()
+        return jsonify({"error": "Invalid token"}), 400
+
+    user.password = new_password
+    user.reset_token = None
+    db.commit()
+    db.close()
+
+    return jsonify({"status": "ok"})
+
+
 import pyotp, base64, os
 
 @app.route("/auth/enable_2fa", methods=["POST"])