goauthentik / goauthentik/authentik
Recovery flow Email stage renders and creates verification token, but send_mail task is never enqueued
- Dominant language
- Python
- Stars
- 25.6k
- Forks
- 2k
- Avg merge
- 1d 1h
- Merged PRs (30d)
- 644
Description
### Describe the bug
Version: 2026.8.2 (Docker)
Description:
Using the bundled example/flows-recovery-email-verification.yaml blueprint (both as originally imported and after fully deleting/recreating the blueprint instance and flow from scratch), the recovery flow's Email stage correctly:
Renders component: "ak-stage-email" after successful identification (confirmed via HAR capture, no email-sent cached response)
Creates a verification token visible under the user's Tokens page
However, authentik.stages.email.tasks.send_mail is never enqueued — confirmed via docker logs authentik_server | grep send_mail and docker logs authentik_worker | grep send_mail at the exact HAR-captured timestamp, both returning no results.
Global email settings are confirmed fully functional: ak test_email successfully sends via the same SMTP configuration (Resend), confirming this is not an SMTP/DNS/credentials issue.
Email stage config: "Use global connection settings" checked, Template = "Password Reset", Subject = "authentik". No policies bound to the stage.
### How to reproduce
1. Import example/flows-recovery-email-verification.yaml as a Blueprint instance
2. Set as brand's Recovery flow
3. Trigger recovery, submit valid username/email
4. Flow correctly advances to Email stage, token is created, but no email is sent and no send_mail task appears in server or worker logs
### Expected behavior
Triggered email send with password recovery url
### Screenshots
_No response_
### Additional context
_No response_
### Deployment Method
Docker
### Version
2026.8.2
### Relevant log output
```shell
```
Contributor guide
Research direction
Start with the recovery flow Email stage and authentik.stages.email.tasks.send_mail, reproducing the bundled example/flows-recovery-email-verification.yaml flow in Docker. Compare the successful token creation with task enqueueing and inspect server and worker logs; done means recovery triggers send_mail and delivers the password recovery email.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- docker, python
- Domain
- authentication, backend
- Issue type
- Bug
- Difficulty
- 3/5
- Estimated time
- 1-2 days
- Activity status
- Active
- Clarity
- Mostly clear
- Newbie friendliness
- 68/100