@User , so the reset password link signed in the user. Then i was able to grab the type of auth state change from the event, which said it was reset password, so I redirected to the form.
Then here's where I'm not sure I did the right thing. Instead of using the reset password example that requires the access token, I used the auth.update user method, which didn't require the token.
Same result.