Users that authenticate with the password backend have the ability to reset their password.
Users have the ability to reset their password from the Login page, using their email address.
When the user submits an email address, the response will always be a
200 OK (for security reasons).
In case the email address is valid, the
password-reset-service will act as follows:
Generate a random
Send a link with the
tokento the provided email address.
Save the token along with the user’s id and an
expiresAttimestamp (set to
now + 30 minutes) in the database.
When the user click’s the link in the email sent from the service, he/she will be taken to a
“Enter new password” page. Upon submission, the
password-reset-service will check if the token is
valid (i.e. if it exists in the database table) and not expired (
now < expiresAt). If so, a
request with be sent to the
auth-service to change the password through an end-point only
accessible to password-reset-service.
⚠️ WARNING: The API listed on this page will likely change to conform with our API conventions. Be careful when building integrations. The following changes are expected:
RPC names will change to conform with the conventions
RPC request and response types will change to conform with the conventions
RPCs which return a page will be collapsed into a single
Some property names will change to be consistent with
Table of Contents¶
Remote Procedure Calls¶
data class NewPasswordRequest( val token: String, val newPassword: String, )
data class PasswordResetRequest( val email: String, )