appwrite/docs/references/account/update-recovery.md

Use this endpoint to complete the user account password reset. Both the userId and token arguments will be passed as query parameters to the redirect URL you have provided when sending your request to the /auth/recovery endpoint.

Please notice that in order to avoid a Redirect Attack the only valid redirect URLs are the ones from domains you have set when adding your platforms in the console interface.