The provisioned password auth supports sign-up and sign-in. A secure reset-token flow must be enabled in the existing auth configuration and sent through the platform notify proxy before this can become a working email action.