I'd recommend email flow like email verification and password reset to last for several days if the secret token is strong enough. Email can be seen as a more s

I'd recommend email flow like email verification and password reset to last for several days if the secret token is strong enough. Email can be seen as a more secure system, so it may not be available immediately and everywhere.