Reset password with OTP

This use case Reset Password Process receives a short code to enter into the next step of the Process flow. This use case is the second half of the “forgot password?” user journey, delivered by the Reset Password Process. In this flow, the user received a short code that they much supply to the Process. An anonymous user has gone through the Recover ID Process, and received an action token in their email or SMS. In this use case, the user receives their action token in the form of a short, custom One-Time Passcode (OTP).

Initial Request: User clicks link

The user goes to their email/SMS and retrieves the OTP. They then enter the OTP into the client application. The application passes both the OTP and the Proof Key for Action Token (PKAT) that it received at the end of the previous Process, into the Session Token API:

**GET https://\{your.url\}/session/token?customToken=549330&amp;pkat=cd02eeae-9295-4974-b211-999bd12d64d7**
<no body>

If both the OTP and PKAT are valid, this API invokes the Reset Password Process.

Response

Storefront Gateway responds with a request for a new password:

**RESPONSE - body**
{
    "processId": "de11cb72-c03b-423f-a6ed-4e13e2c6ddd2",
    "processName": "recovery.PasswordReset.v1.0",
    "displayMessage": "Please input required information",
    "parameters": {
        "newPassword": "String"
    },
    "stepName": "NewPasswordPrompt",
    "lastStep": false
}

`processId`	Unique identifier for the current instance of this Process.
`processName`	Full name of the Process, including the category and version number.
`stepName`	Name of the specific step that the Process is currently on.
`lastStep`	Boolean that indicates whether or not this was the last step in the Process.
`displayMessage`	Optional message that the UI can display to the user.
`parameters`	Object that specifies the info this Process requires to continue its task.
`newPassword`	The new password, as required by the Process.

Final Request: User Password

Your client calls the Process Step API, and passes the user-supplied password to the Process:

**PUT https://\{your.url\}/process/step**
{
    "processId": "de11cb72-c03b-423f-a6ed-4e13e2c6ddd2",
    "parameters": {
        "newPassword": "Sp4rinkl35"
    }
}

`processId`	Unique identifier for the current instance of this Process.
`parameters`	Data object that contains the data request in the previous Process response.
`newPassword`	The new password, as supplied by the user.

Process Complete

If the password passes complexity rules, then Storefront Gateway replaces the user’s paword. The Process completes and returns a 200 HTTP status:

**RESPONSE - body**
{
    "processId": "de11cb72-c03b-423f-a6ed-4e13e2c6ddd2",
    "processName": "recovery.PasswordReset.v1.0",
    "lastStep": true
}

Storefront Gateway automatically closes any and all open sessions that the user may have. The user will need to sign in with their new password.

`processId`	Unique identifier for the current instance of this Process.
`processName`	Full name of the Process, including the category and version number.
`lastStep`	Boolean that indicates whether or not this was the last step in the Process.
Parent topic:Recover ID & Reset Password Processes

Home

Introduction

For Merchants

For Resellers

Partner Ecosystem Management

Commerce Engine

Storefront Experience

APIs

Initial Request: User clicks link

Response

Final Request: User Password

Process Complete

​Initial Request: User clicks link

​Response

​Final Request: User Password

​Process Complete

Initial Request: User clicks link

Response

Final Request: User Password

Process Complete