Login with Forgot Password Email OTP – Google Apps Script

B9 is the login page with the part most Apps Script logins leave out — a working forgot password. Not a note telling people to email the admin, but a proper flow: prove you own the address, receive a one-time code, and set a new password that has to be a real one.

The reset flow, step by step

Pressing Reset asks for confirmation first, so nobody starts the process by misclick. Then you enter your email. If that address is not in the sheet, the app says so plainly and stops — no code is sent to an address that has no account, and a blank or malformed entry is rejected before the request goes anywhere. When the email does match, a six digit OTP is mailed to it and the password fields stay locked until that code is entered correctly.

A password rule that means something

The new password must be at least eight characters and mix upper case, lower case, a number and a special character. The rule is stated on screen and enforced, so people cannot quietly reset to something shorter than what they had. Once it is saved, a confirmation email goes out telling the account holder their password was changed — which is how somebody finds out if a reset was not them.

Blocking a user without deleting them

Every account carries an approval state. Set it to disapproved and that person is told they are blocked by the admin instead of being let in, and the attempt is written to an activity sheet with the account, the date and the time. Approve them again and they are back. One cell governs access, and the record of the attempts survives either way.

After login

A successful login opens the page you nominate, loaded without its address being exposed on screen, so the destination link is not handed out to whoever gets through the form.