> ## Documentation Index
> Fetch the complete documentation index at: https://docs.m1amdocs.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Update Password Process

This Process updates an authenticated user's current password with a new one.

**Note:** If the user onboarded with their social account, and do not currently have a password, they can use this Process to add one.

## Process Flow

This flow describes the Process at a high level.

**Preconditions**

* The user is currently authenticated.

**Basic Flow**

1. The user navigates to their profile or settings menu, and selects to update their password.

2. Storefront Gateway request the user's current password and new password.

   **Note:** If the user does not yet have a password, then they only need to provide the one new password.

3. The user enters each password in their respective field, and clicks **Change Password**. The client passes that input back to Storefront Gateway.

4. Storefront Gateway verifies the old password to authorize the change, and then verifies the new password.

   **Note:** The Process accepts or rejects the new password based your organization's **Password Complexity Rules** setting. This setting is configured in the Admin Portal on the [Password](passwordSettingsFields_r) page.

5. Storefront Gateway hashes and saves the new password in the place of the old password. The service also invalidates any and all open sessions, remember me tokens, access tokens, and refresh tokens except for this current session as well as any Relying Party tokens.

**Post-conditions**

* The user has successfully updated their password.

**Possible or Common Errors**

* Invalid password (for the current password). Please try again.
* The provided password does not match validation rules in terms of length, alphanumeric complexity, or forbidden/common passwords.
* Password cannot be blank.
* User has failed and exceeded the maximum number of retries.

## App Settings

Certain aspects of the Process' behavior are controlled by configurable system settings. Your organization manages these settings in the Storefront Gateway Admin console.

| Application Settings | Default Setting | | |
| - | - | - | - |
| **Max failed input attempts** | Maximum number of times the Process rejects bad input (invalid password) before ending. | 10 | |
| **Password complexity rules** | Defines the criteria for a valid password when the user is onboarding, or resetting/updating their password. Configuration points include:- **Upper case characters** - The password requires at least one uppercase (A-Z) character. - **Lower case characters**The password requires at least one lowercase (a-z) character. - **Special characters**The password requires at least one [special character](reusePasswordSettingSpecialCharsList). - The password requires at least one numeric (0-9) character. - The minimum password length. | - A-Z: Enabled - a-z: Enabled - (!"#\$%&'()\*+,-./:;=>?@\[\\]^\_\`\{\\ | \}\~): Enabled - 0-9: Enabled - Minimum length: 8 |

## User Journey Flow Diagram

This diagram illustrates the standard user journey using the **Update Password** Process.

<img src="https://mintcdn.com/amdocs-spbu/_Twl74NQXCAg2nPh/marketONE/sgProcessGuide/images/sfgw_userJourneyUpdatePassword.png?fit=max&auto=format&n=_Twl74NQXCAg2nPh&q=85&s=6a9599a1f137e33ccfe8098e93f54076" alt="" width="1750" height="2247" data-path="marketONE/sgProcessGuide/images/sfgw_userJourneyUpdatePassword.png" />

## Use Cases

The following use cases provides a guided API walk-through of this Process for client developers:

* [Update user password](c_useCaseUpdatePassword)

* [Password update errors](c_passwordErrors)

* **[Update user password](c_useCaseUpdatePassword)**

* **[Password Update Errors](c_passwordErrors)**

**Parent topic:**[Identity Management Processes](../images/c_identityProcesses)


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.