That's what made me confused. There is no way to "change" password, only to create a new profile and migrate to it. And you can have many profiles at the same t

That's what made me confused. There is no way to "change" password, only to create a new profile and migrate to it. And you can have many profiles at the same time (some with equal email). >For automation you also have to store the list of websites you've registered with somewhere. Since your system works on multiple clients, that place has to be central. The plan is: until we have 1000+ origins using the protocol, there will be a manual list of origins that will be tried for reset. After that, it will be sorted out with a central server and encrypted list of origins. Sounds good? > you absolutely want to authenticate the client (it might not always be the user's own browser) in addition to the user/grant Cool part is you still can. Provider can look at "client" the token was issued to, and reject if it does not match with some authorized Client record in the database. It's rather flexible for any scenario.