The documentation of Laravel says:

You may be wondering how Laravel knows how to retrieve the user record from your application’s database when calling the Password facade’s sendResetLink method. The Laravel password broker utilizes your authentication system’s "user providers" to retrieve database records. The user provider used by the password broker is configured within the passwords configuration array of your config/auth.php configuration file. To learn more about writing custom user providers, consult the authentication documentation

But how to set my custom password broker users:foo to be used by Password::sendResetLink in my custom package packages/custom-packages/foo/src/routes/api.php?

Route::post('forgot-password', function (Request $request) {
    $request->validate(['email' => 'required|email|exists:foo.users,email']);
    $status = Password::sendResetLink(
        $request->only('email')
    );
    return $status === Password::RESET_LINK_SENT
        ? response()->json(['status' => __($status)])
        : response()->json(['email' => __($status)]);
});

Below is my config/auth.php:

...
'passwords' => [
    'users' => [
        'provider' => 'users',
        'table' => 'password_resets',
        'expire' => 60,
        'throttle' => 60,
    ],
    'users:foo' => [
        'provider' => 'users:foo',
        'table' => 'foo.password_resets',
        'expire' => 60,
        'throttle' => 60,
    ]
]

Source: Laravel