# Forgot password API? **URL:** \ **Category:** REST API\ **Created:** [June 30, 2015, 7:35am UTC](https://community.dreamfactory.com/t/forgot-password-api/1236 "2015-06-30T07:35:03Z")\ **Posts on this page:** 14\ **Page:** 1
**Author:** ![allensandiego](https://avatars.discourse-cdn.com/v4/letter/a/8baadc/32.png) [@allensandiego](https://community.dreamfactory.com/u/allensandiego)\ **Post date:** [June 30, 2015, 7:35am UTC](https://community.dreamfactory.com/t/forgot-password-api/1236/1 "2015-06-30T07:35:03Z")
Hi, Looking through the API Documents for the user, I noticed that there was no option for a Forgot Password scenario. Is there any other way we can do this through Rest? Thanks, Allen ---
**Author:** ![jeffreystables](https://yyz1.discourse-cdn.com/flex035/user_avatar/community.dreamfactory.com/jeffreystables/32/173_2.png) [@jeffreystables](https://community.dreamfactory.com/u/jeffreystables)\ **Post date:** [June 30, 2015, 6:49pm UTC](https://community.dreamfactory.com/t/forgot-password-api/1236/2 "2015-06-30T18:49:26Z")
Although not in API Docs (testing it would invalidate the credentials and session you’re using to access API Docs, which is probably a Bad Thing to do in testing), the API call would be: ``` /rest/user/password?reset=true ``` The payload would take the format: ``` {email: "user@domain.com", password: "password", reset: true} ``` Of course, `/rest/user` is the email provided, and unless you have the current password, I’m not sure this call will work. ---
**Author:** ![allensandiego](https://avatars.discourse-cdn.com/v4/letter/a/8baadc/32.png) [@allensandiego](https://community.dreamfactory.com/u/allensandiego)\ **Post date:** [July 1, 2015, 1:12am UTC](https://community.dreamfactory.com/t/forgot-password-api/1236/3 "2015-07-01T01:12:00Z")
Hi, Thanks for the response. But I don’t think this will work since the user forgot the password. Or is the password mentioned in the payload the “new” password? I was hoping for something like the system requesting the email address registered to the user. Then system sends the user an email with a link to reset the password. This kind of approach. Can this be implemented through customization? Or possibly creating a new application with this feature? Best Regards, Allen ---
**Author:** ![jeffreystables](https://yyz1.discourse-cdn.com/flex035/user_avatar/community.dreamfactory.com/jeffreystables/32/173_2.png) [@jeffreystables](https://community.dreamfactory.com/u/jeffreystables)\ **Post date:** [July 1, 2015, 8:05pm UTC](https://community.dreamfactory.com/t/forgot-password-api/1236/4 "2015-07-01T20:05:40Z")
> [@allensandiego](#): > > I don’t think this will work since the user forgot the password. Right, that’s why I started there and explained the basic call with a known password first. Again, the same function can be handled several ways so the API Docs are a bit limited in letting you know the possibilities. There are two ways to go, depending on your desired setup and UX: **1) Security question + answer** Assuming you have `/user/profile` set up something like this: ```auto { "first_name": "User", "last_name": "Name", "display_name": "User Name", "email": "user@domain.com", "security_question": "What is the airspeed velocity of an unladen swallow?", "security_answer": "Less than twelve parsecs." } ``` Then to reset the user’s password, ``` POST https://api.mydomain.com/rest/user/password ``` JSON ```auto { "email": "user@domain.com", "security_answer": "Less than twelve parsecs.", "new_password": "newpassword" } ``` If you need `security_question` returned to the client to display the challenge in your app, simply `POST` with just the email, and `security_question` will be returned. **2) Email reset code** ``` POST https://api.mydomain.com/rest/user/password ``` JSON ```auto { "email": "user@domain.com", "reset": true } ``` This will generate an email to the user’s email address that includes a reset link and confirmation code. This email will be sent using the email service and template you’ve configured under Config \> Password Reset. > From: App Name `` > Date: Wed, 01 Jul 2015 15:17:58 -0400 > Subject: Password Reset > To: [user@domain.com](mailto:user@domain.com) > Hi User, > You have requested to reset your password. Go to the following url, enter the code below, and set your new password. > [https://api.mydomain.com/dist/#/reset-password](https://api.mydomain.com/dist/#/reset-password) > Confirmation Code: cdcb9df20bb2edd3037b86080572a2bb > Thanks, > App Name I believe email reset will only work if the user in question does not have `security_question` and `security_answer` set up in his profile. > [@allensandiego](#): > > Can this be implemented through customization? Or possibly creating a new application with this feature? Probably yes, but the API already has this functionality so these options should only be necessary in the narrowest of use cases. ---
**Author:** ![mrvipinkashyap](https://avatars.discourse-cdn.com/v4/letter/m/977dab/32.png) [@mrvipinkashyap](https://community.dreamfactory.com/u/mrvipinkashyap)\ **Post date:** [July 7, 2016, 5:32pm UTC](https://community.dreamfactory.com/t/forgot-password-api/1236/5 "2016-07-07T17:32:41Z")
@jeffreystables Can you please clarify where would this “Confirmation code” be added to email? Should it be added to the API call used to generate email or should it be added to parameter list of email service on Dreamfactory? I have actually tried both and receiving code in email but on making call to this api: > POST /api/v2/user/password with parameters: > { > code : “12345”, > email : “[my@email.com](mailto:my@email.com)”, > new\_password : “my\_new\_password” > } I am getting this response message: > The supplied email and/or confirmation code were not found in the system Any clues on what I might be doing wrong? ---
**Author:** ![formerstaff](https://yyz1.discourse-cdn.com/flex035/user_avatar/community.dreamfactory.com/formerstaff/32/1133_2.png) [@formerstaff](https://community.dreamfactory.com/u/formerstaff)\ **Post date:** [July 15, 2016, 5:03pm UTC](https://community.dreamfactory.com/t/forgot-password-api/1236/6 "2016-07-15T17:03:30Z")
To initiate a password reset request POST user/password?reset=true `{"email":"youremail@yourdomain.com"}` OR POST user/password `{"email":"youremail@yourdomain.com","reset":true}` This will email you a confirmation code. Once you receive the code, you may reset your password with POST user/password `{"email":"youremail@yourdomain.com","code":"the confirmation code from the email","new_password":"your new password"}` ---
**Author:** ![csantos](https://avatars.discourse-cdn.com/v4/letter/c/71c47a/32.png) [@csantos](https://community.dreamfactory.com/u/csantos)\ **Post date:** [August 5, 2016, 2:24pm UTC](https://community.dreamfactory.com/t/forgot-password-api/1236/7 "2016-08-05T14:24:36Z")
Hi, We’re using the API recommended by @drewpearce and it works, but only for the first time. We first request the code and then send the code to set the new password of a user, and works. The second time we test, the code request works (reset=true), but the set new password call fails due to: `{"error":{"context":null,"message":"Error processing password reset.\nThe token has been blacklisted","code":500,"trace":["0 /home/ubuntu/dreamfactory-2.2.0-0/apps/dreamfactory/htdocs/vendor/dreamfactory/df-core/src/Resources/UserPasswordResource.php(69)...` We’re using DF v2.2.0. Any ideas why this happens? Thanks! ---
**Author:** ![formerstaff](https://yyz1.discourse-cdn.com/flex035/user_avatar/community.dreamfactory.com/formerstaff/32/1133_2.png) [@formerstaff](https://community.dreamfactory.com/u/formerstaff)\ **Post date:** [August 16, 2016, 2:54pm UTC](https://community.dreamfactory.com/t/forgot-password-api/1236/8 "2016-08-16T14:54:48Z")
Token Blacklisted indicates that the session token provided in the API call is no longer valid. You do not need to pass a session token on the confirmation part of a password reset call. ---
**Author:** ![vijayst](https://yyz1.discourse-cdn.com/flex035/user_avatar/community.dreamfactory.com/vijayst/32/801_2.png) [@vijayst](https://community.dreamfactory.com/u/vijayst)\ **Post date:** [August 18, 2016, 1:58pm UTC](https://community.dreamfactory.com/t/forgot-password-api/1236/9 "2016-08-18T13:58:46Z")
We are not passing any session token. Still, we get the token blacklisted error. Any other reason why this happens? ---
**Author:** ![formerstaff](https://yyz1.discourse-cdn.com/flex035/user_avatar/community.dreamfactory.com/formerstaff/32/1133_2.png) [@formerstaff](https://community.dreamfactory.com/u/formerstaff)\ **Post date:** [August 26, 2016, 7:56pm UTC](https://community.dreamfactory.com/t/forgot-password-api/1236/10 "2016-08-26T19:56:20Z")
Is this being done in browser? It’s possible that the browser is still trying to reuse a session. ---
**Author:** ![goblin](https://avatars.discourse-cdn.com/v4/letter/g/f4b2a3/32.png) [@goblin](https://community.dreamfactory.com/u/goblin)\ **Post date:** [August 27, 2016, 6:12pm UTC](https://community.dreamfactory.com/t/forgot-password-api/1236/11 "2016-08-27T18:12:45Z")
Yes, I’m doing this from the browser. I have tried to localStorage.clear(); and sessionStorage.clear(); before sending the request and it still dosn’t work. The thing is that it always work for the first reset, but on any reset for the same user after that, the token gets permanently blacklisted and the password can’t be changed, not even from the admin panel. However, the user can still log in to the system with the old password. So this really seems to be a bug in Dreamfactory. ---
**Author:** ![goblin](https://avatars.discourse-cdn.com/v4/letter/g/f4b2a3/32.png) [@goblin](https://community.dreamfactory.com/u/goblin)\ **Post date:** [August 29, 2016, 1:15pm UTC](https://community.dreamfactory.com/t/forgot-password-api/1236/12 "2016-08-29T13:15:22Z")
Just to clearify. The localStorage.clear(); do clear all the sessions, but it still does only work a couple of times and then it get blacklisted. ---
**Author:** ![formerstaff](https://yyz1.discourse-cdn.com/flex035/user_avatar/community.dreamfactory.com/formerstaff/32/1133_2.png) [@formerstaff](https://community.dreamfactory.com/u/formerstaff)\ **Post date:** [September 7, 2016, 5:40pm UTC](https://community.dreamfactory.com/t/forgot-password-api/1236/13 "2016-09-07T17:40:34Z")
Sorry. I’m not able to duplicate the error, after much trying. Can you be very specific about how this is happening? What version of DramFactory? What exactly are you doing, password recovery (“i forgot my password”) or password reset of an already logged in user. Are you logging out and logging in between the two attempts? Are you using the DreamFactory admin application for this or a custom built application? Thanks. ---
**Author:** ![Kevin\_Mcgahey](https://avatars.discourse-cdn.com/v4/letter/k/b3f665/32.png) [@Kevin\_Mcgahey](https://community.dreamfactory.com/u/Kevin_Mcgahey)\ **Post date:** [March 18, 2020, 9:01pm UTC](https://community.dreamfactory.com/t/forgot-password-api/1236/17 "2020-03-18T21:01:32Z")
To avoid getting locked out of your instance we recommend enabling email support upon installation of DreamFactory. This will allow you to take advantage of the “Forgot Password” button on login. Our Guide has a handy section on this specifically: “[Enabling Email Registration](https://guide.dreamfactory.com/docs/chapter02.html#enabling-email-registration)” If you are already locked out of your instance and you are running a Bitnami install there is a possible workaround that can be used as a last ditch effort. This would require you logging in to your system database and deleting all users you have created. Once deleted you can go back to the browser and you should be redirected to create your first Admin.