fix

apps/api/internal/httpapi/admin_handlers.go

@@ -216,6 +216,7 @@ func (s *Server) handleAdminSendSetPasswordEmails(w http.ResponseWriter, r *http
 	skippedRateLimited := 0
 	skippedSend := 0
 	var singleToken string
+	var singleMode string
 	singleUser := body.UserID != nil
 
 	for _, uid := range targets {
@@ -251,6 +252,11 @@ func (s *Server) handleAdminSendSetPasswordEmails(w http.ResponseWriter, r *http
 		if err := s.Mail.Send(msg); err != nil {
 			log.Printf("admin set-password send failed user_id=%s", uid)
 			skippedSend++
+			if singleUser {
+				// Still return the one-time link so admins can share it while impersonating / offline SMTP.
+				singleToken = token
+				singleMode = mode
+			}
 			continue
 		}
 		if smtpOn {
@@ -258,6 +264,7 @@ func (s *Server) handleAdminSendSetPasswordEmails(w http.ResponseWriter, r *http
 		} else if singleUser {
 			// Share token only for single-user reissue when SMTP is off (no email in response).
 			singleToken = token
+			singleMode = mode
 		}
 	}
 
@@ -275,6 +282,11 @@ func (s *Server) handleAdminSendSetPasswordEmails(w http.ResponseWriter, r *http
 	}
 	if singleToken != "" {
 		resp["token"] = singleToken
+		if singleMode == "hmac" {
+			resp["accept_url"] = mail.SetPasswordURL(s.Config.WebOrigin, singleToken)
+		} else {
+			resp["accept_url"] = mail.AcceptInviteURL(s.Config.WebOrigin, singleToken)
+		}
 	}
 	JSON(w, http.StatusOK, resp)
 }