The field is not required. I tried different scenarios (filled it/left it blank) but it seemed it didn't do any difference..?
Thanks
starved
11/25/2025, 5:20 AM
Whether I [leave it blank/enter a valid project name/enter a non-exist project name], it will successfully set the user's password. So I don't know what this field would do
f
finnbergquist
11/25/2025, 6:10 PM
Hi @starved ,
If projectId IS provided, it first searches for a User in the specified project (project scoped user) with a matching email to reset their password
If projectId is NOT provided or the first search fails, it searches for a server scoped User with a matching email to reset their password
[Here](https://github.com/medplum/medplum/blob/ec580462ffb705f4de5e6dc6d8748c181e56503e/packages/server/src/oauth/utils.ts#L696-L710) is the relevant code snippet where this fallback logic is handled