Password Reset with Email

Use the Shopper Login and API Access Service (SLAS) to send a password reset email to a registered shopper. The shopper can then update their password after verifying a one-time password (OTP) contained in the email.

The implementation described in this guide requires no third-party integration. For instructions on password reset using a callback URI instead, see Password Reset with Callback URI.

Considerations

Registration: The shopper’s email must be registered with B2C Commerce.
Volume limits: The monthly quota limit for the getPasswordResetToken endpoint with mode set to email is 1,000 requests per non-production tenant instance. The getPasswordResetToken endpoint also has a maximum of 3 requests per user for every 10-minute window.
SLAS client: Your site must have a SLAS client. Both private and public clients are supported. See Authorization for Shopper APIs.
DMARC policies: Support is currently limited to email sender domains with relaxed DMARC policies (p=none).

1. Add an Email Sender to the SLAS Client

An email sender specifies the sender address that SLAS uses to deliver passwordless login emails, including password reset emails. Use the SLAS Admin UI to add an email sender to an existing SLAS client. Follow the steps to Add an Email Sender as described in the Password Login with Email guide.

2. Create a Password Action Template

SLAS uses password action templates to construct the emails used for password resets, as well as passwordless login.

To create the password action template for password reset emails, make a PUT request to the registerPwdlessTemplate endpoint. Set the actionType parameter to PWD_RESET_ACTION and the templateType parameter to EMAIL. Alternatively, the PWD_RESET_CROSS_DEVICE_ACTION is used if the hint parameter in the getPasswordResetToken call is cross_device.

In the link parameter, use ${token}, ${name}, and ${user_id} substitutions. In the template parameter, use the above and the ${link} substitution.

Emails with OTP that use the SLAS APIs for getPasswordResetToken will use this template to send emails to shoppers.

Here’s an example request body for creating a password reset email template:

1{
2  "channelId": "SiteGenesis",
3  "name": "Password Reset Email Template",
4  "subject": "Password Reset Token Request",
5  "link": "https://store.com/reset-password?token=${token}&email=${user_id}",
6  "locale": "en-us",
7  "actionType": "PWD_RESET_ACTION",
8  "templateType": "EMAIL",
9  "template": "Password Reset Request\n\nHello ${name},\n\nYou're receiving this because you requested a password reset for your account.\n${link}\n\nThis link will expire shortly. Do not share it with anyone."
10}

3. Implement the Password Reset Token Flow

Call the getPasswordResetToken endpoint to trigger the email with the OTP. Setting the mode to email instructs SLAS to send the numeric token directly to the shopper’s registered email address.
Then, call the resetPassword endpoint with the shopper’s numeric token to complete the password reset flow.

SLAS Private Client Example:

Request a password reset token

1curl --location 'https://{shortCode}.api.commercecloud.salesforce.com/shopper/auth/v1/organizations/{organizationId}/oauth2/password/reset' \
2--header 'Content-Type: application/x-www-form-urlencoded' \
3--header 'Authorization: Basic {base64_client_credentials}' \
4--data-urlencode 'user_id=darth.vader' \
5--data-urlencode 'mode=email' \
6--data-urlencode 'channel_id=SiteGenesis' \
7--data-urlencode 'code_challenge=si9PvGgxix3wYge5GrPJO-EPJ9JxLhn6y2_fb8PlUwg'

After the customer provides the reset token, use it to request a password reset:

1curl --location 'https://{shortCode}.api.commercecloud.salesforce.com/shopper/auth/v1/organizations/{organizationId}/oauth2/password/action' \
2--header 'Content-Type: application/x-www-form-urlencoded' \
3--header 'Authorization: Basic {base64_client_credentials}' \
4--data-urlencode 'pwd_action_token=12345678' \
5--data-urlencode 'user_id=darth.vader' \
6--data-urlencode 'new_password=NewSecurePassword123!' \
7--data-urlencode 'channel_id=SiteGenesis' \
8--data-urlencode 'code_verifier=WyGUskLWv5rRF_-jQdMnKcm48xJzo_CQoMGMKtyQfTh-vhMfPUfGGGesHCP2bQsZ5F07p08QJIJOFlcFAtEMBA'

SLAS Public Client Example

Request a password reset token:

1curl --location 'https://{shortCode}.api.commercecloud.salesforce.com/shopper/auth/v1/organizations/{organizationId}/oauth2/password/reset' \
2--header 'Content-Type: application/x-www-form-urlencoded' \
3--data-urlencode 'client_id=12345678-1234-1234-1234-123456789012' \
4--data-urlencode 'user_id=darth.vader' \
5--data-urlencode 'mode=email' \
6--data-urlencode 'channel_id=SiteGenesis' \
7--data-urlencode 'code_challenge=si9PvGgxix3wYge5GrPJO-EPJ9JxLhn6y2_fb8PlUwg'

After the customer provides the reset token, use it to request a password reset:

1curl --location 'https://{shortCode}.api.commercecloud.salesforce.com/shopper/auth/v1/organizations/{organizationId}/oauth2/password/action' \
2--header 'Content-Type: application/x-www-form-urlencoded' \
3--data-urlencode 'client_id=12345678-1234-1234-1234-123456789012' \
4--data-urlencode 'pwd_action_token=12345678' \
5--data-urlencode 'user_id=darth.vader' \
6--data-urlencode 'new_password=NewSecurePassword123!' \
7--data-urlencode 'channel_id=SiteGenesis' \
8--data-urlencode 'code_verifier=WyGUskLWv5rRF_-jQdMnKcm48xJzo_CQoMGMKtyQfTh-vhMfPUfGGGesHCP2bQsZ5F07p08QJIJOFlcFAtEMBA'

Troubleshooting

To diagnose issues with password reset emails, use Log Center. For details, see Troubleshooting with Log Center.