Username, phone or email
You should generate your own waterfall id (randomUUID()). It should be the same for the whole password reset flow.
Username, phone or email