AdminAuth::password() registers two routes. The e-mail contains a link of your client application, which sends the token back with the new password.
routes/api.php
config/admin_helpers.php
auth.passwords entry of the provider is created with the password_reset_tokens table. Use the AdminHelpers\Auth\Concerns\HasPasswordResetLink trait in the model, so the CrudAdmin reset e-mail links to reset_url instead of the administration, or define getResetLink($token) yourself.
Sending the link
POST auth/password/forgot with email. The answer is the same success message whether the account exists or not. Throttled like OTP codes.
Setting the password
POST auth/password/reset with token, email, password and password_confirmation. The password is saved, the e-mail is marked as verified and the user is signed in: the response is the login response with a token named password. An invalid or expired token answers 422.
Override passwordRules() in your controller (extend AdminHelpers\Auth\Controllers\PasswordController) to change the validation. Keep the maximum below 60 characters: CrudAdmin stores a 60 characters value as an existing hash.
Link to set the first password
Accounts created without a password, e.g. during an order, get a link instead of a random password:AdminHelpers\Auth\Notifications\SetPasswordNotification. The client app uses the same auth/password/reset route. PasswordReset::broker($guard) and PasswordReset::url($user, $token) are available for custom notifications.