[Python] Best practices for building password reset flow without third-party email/SMS...

I’m building a secure admin panel and want to implement a password reset flow that avoids third-party services (like SendGrid, Mailgun, Twilio, etc.) for privacy and full control.

I’m looking for:

1. Best practices for sending password reset emails/SMS from a self-hosted system
2. Recommendations for email servers, SMS gateways, and Python libraries for token generation and validation
3. Security considerations (token expiry, replay protection, etc.)

I’m currently using [Flask / FastAPI]. The database is MySQL. Has anyone done something similar in a production environment? What would you recommend in terms of tools and architecture? Thanks!

I’m building a self-hosted password reset system using Flask/FastAPI and MySQL. I want to avoid third-party services and was expecting to find open-source tools for email/SMS delivery and secure token handling.

Continue reading...