Use a durable reset-request record as the gate, issue at most one recent token per seller, and treat an email API timeout as an unknown result rather than a failed send. Retry only after reconciling the recorded send with the provider's message status where that is possible. The timeout policy ...
Source: [Dev.to](https://dev.to/garrisonsterling2693/nodejs-serverless-password-reset-email-idempotent-recovery-after-api-timeouts-2pl2)