diff --git a/models/user.js b/models/user.js
index c6197a220..f4edc8f63 100644
--- a/models/user.js
+++ b/models/user.js
@@ -1,6 +1,7 @@
 const mongoose = require('../mongoose');
 const uuid = require('uuid');
 const bcrypt = require('bcrypt');
+const jwt = require('jsonwebtoken');
 
 const SALT_ROUNDS = 10;
 
@@ -83,10 +84,15 @@ UserSchema.options.toObject.transform = (doc, ret, options) => {
  * @param  {Function} done     [description]
  */
 UserSchema.statics.findLocalUser = function(email, password) {
+
+  if (!email || typeof email !== 'string') {
+    return Promise.reject('email is required for findLocalUser');
+  }
+
   return User.findOne({
     profiles: {
       $elemMatch: {
-        id: email,
+        id: email.toLowerCase(),
         provider: 'local'
       }
     }
@@ -221,6 +227,8 @@ UserSchema.statics.createLocalUser = function(email, password, displayName) {
     return Promise.reject('email is required');
   }
 
+  email = email.toLowerCase();
+
   if (!password) {
     return Promise.reject('password is required');
   }
@@ -338,6 +346,20 @@ UserSchema.statics.findByIdArray = function(ids) {
   });
 };
 
+UserSchema.statics.createJWT = function (email) {
+  if (!email || typeof email !== 'string') {
+    return Promise.reject('email is required when creating a JWT for resetting passord');
+  }
+
+  email = email.toLowerCase();
+
+  const payload = {email, jti: uuid.v4()};
+
+  const token = jwt.sign(payload, process.env.TALK_SESSION_SECRET, {expiresIn: '1d'});
+
+  return Promise.resolve(token);
+};
+
 const User = mongoose.model('User', UserSchema);
 
 module.exports = User;
diff --git a/package.json b/package.json
index ad0e2dbb0..76173b7aa 100644
--- a/package.json
+++ b/package.json
@@ -51,13 +51,13 @@
     "debug": "^2.2.0",
     "ejs": "^2.5.2",
     "express": "^4.14.0",
+    "jsonwebtoken": "^7.1.9",
     "lodash": "^4.16.6",
     "mongoose": "^4.6.5",
     "morgan": "^1.7.0",
     "nodemailer": "^2.6.4",
     "nodemailer-sendgrid-transport": "^0.2.0",
     "prompt": "^1.0.0",
-    "react-mdl-selectfield": "^0.2.0",
     "uuid": "^2.0.3"
   },
   "devDependencies": {
@@ -107,6 +107,7 @@
     "react": "15.3.2",
     "react-dom": "15.3.2",
     "react-mdl": "^1.7.2",
+    "react-mdl-selectfield": "^0.2.0",
     "react-onclickoutside": "^5.7.1",
     "react-redux": "^4.4.5",
     "react-router": "^3.0.0",
diff --git a/routes/admin/index.js b/routes/admin/index.js
index 52957f54a..84c130ba8 100644
--- a/routes/admin/index.js
+++ b/routes/admin/index.js
@@ -1,11 +1,23 @@
 const express = require('express');
-
+const jwt = require('jsonwebtoken');
 const router = express.Router();
 
 router.get('/embed/stream/preview', (req, res) => {
   res.render('embed-stream', {basePath: '/client/embed/stream'});
 });
 
+router.get('/password-reset/:token', (req, res, next) => {
+  jwt.verify(req.params.token, process.env.TALK_SESSION_SECRET, (error, decoded) => {
+    if (error) {
+      return res.status(400).json({error});
+    }
+
+    console.log(decoded);
+
+    res.json(decoded);
+  });
+});
+
 router.get('*', (req, res) => {
   res.render('admin', {basePath: '/client/coral-admin'});
 });
diff --git a/routes/api/user/index.js b/routes/api/user/index.js
index 4665f4e52..c0bc43c6a 100644
--- a/routes/api/user/index.js
+++ b/routes/api/user/index.js
@@ -1,6 +1,7 @@
 const express = require('express');
 const router = express.Router();
 const User = require('../../../models/user');
+const mailer = require('../../../services/mailer');
 
 router.get('/', (req, res, next) => {
   const {
@@ -70,4 +71,37 @@ router.post('/:user_id/role', (req, res, next) => {
   .catch(next);
 });
 
+/**
+ * this endpoint takes an email (username) and checks if it belongs to a User account
+ * if it does, create a JWT and send an email
+ */
+router.post('/request-password-reset', (req, res, next) => {
+  const {email} = req.body;
+
+  console.log('/request-password-reset', req.body);
+
+  if (!email) {
+    return next();
+  }
+
+  User
+    .createJWT(email)
+    .then(token => {
+      const options = {
+        subject: 'password reset requested',
+        from: 'coralcore@mozillafoundation.org',
+        to: 'riley.davis@gmail.com',
+        html: `<a href="http://localhost:3000/admin/password-reset/${token}">reset password</a>`
+      };
+      return mailer.sendSimple(options);
+    })
+    .then(success => {
+      console.log(success);
+      res.json({success: true});
+    })
+    .catch(error => {
+      res.status(500).json({error});
+    });
+});
+
 module.exports = router;
diff --git a/services/mailer.js b/services/mailer.js
index ec1dd5f5e..eb900d782 100644
--- a/services/mailer.js
+++ b/services/mailer.js
@@ -8,23 +8,6 @@ const options = {
 
 const transporter = nodemailer.createTransport(sgTransport(options));
 
-transporter.sendMail({
-  from: 'support@mrdavis.com',
-  to: 'riley.davis@gmail.com',
-  subject: 'this is only a test',
-  text: 'this is the body of the email maybe?',
-  html: `<table>
-          <thead>
-            <tr><th>foo</th><th>bar</th><tr>
-          </thead>
-          <tbody>
-            <tr>
-              <td>riley</td><td>davis</td>
-            </tr>
-          </tbody>
-        </table>`
-});
-
 const mailer = {
   /**
    * sendSimple