Skip to main content
Version: 12.x

Password Reset

Most web applications provide a way for users to reset their forgotten passwords. Rather than forcing you to re-implement this by hand for every application you create, Apiato provides convenient services for sending password reset links and secure resetting passwords.

Configuration​

All the configuration options for the password reset feature are located in the app/Containers/AppSection/Authorization/Configs/appSection-authentication configuration file.

Make sure that you have configured the MAIL_FROM_ADDRESS in your .env file.

Include your web app's password reset page URL, such as https://myapp.com/password/reset, in the allowed-reset-password-urls array within the appSection-authentication configuration.

Routing​

To request a password reset link, call the /password/forgot endpoint with the user's email address.

Resetting The Password​

To reset the user's password, call the /password/reset endpoint with the user's email address, new password, and password reset token.

Process Flow​

  1. Add your web app's password reset page URL, for example, https://myapp.com/password/reset, to the allowed-reset-password-urls array within the appSection-authentication configuration.

  2. Call the /password/forgot endpoint with a reset URL of your choice, which should correspond to one of the URLs in the allowed-reset-password-urls array. This endpoint will send the user an email containing a link like this:
    https://myapp.com/password/[email protected]&token=51f8d80182f3785648c9b9dc7162719d158fc418b3cca86c14963638ec83d663

  3. When the user clicks on that link, they will be directed to your front-end app's password reset page. From there, you can collect the user's new password and make a call to the /password/reset endpoint with all the required fields to complete the password reset.