---
schema_version: "1"
id: 6cadcfcf03c8e857357a4c105fc39e4fb365a1d0e9e68f0b27c835c161a784f0
title: Configure Experience Cloud Settings for the Headless Forgot Password Flow
collection: admin
version: current
locale: en-us
portal_url: https://docs.salesforce.com/admin/current/en-us/xcloud/264-0-0/configure_headless_forgot_password_flow.md
canonical_url: https://help.salesforce.com/s/articleView?id=xcloud.configure_headless_forgot_password_flow.htm&release=264.0.0&type=5
source_site: help.salesforce.com
content_type: documentation
content_hash: cfe924ec9b481919274a3ba4cbc414701f92bd68d01bfd4bf35ab0fd3079c99f
description: Before you set up the Headless Forgot Password Flow, configure settings to control security and access for your off-platform app.
products:
  - Security
  - Cross Cloud
release: "264"
---
# Configure Experience Cloud Settings for the Headless Forgot Password Flow

Before you set up the Headless Forgot Password Flow, configure settings to control security and access for your off-platform app.

### Required Editions

<table class="slds-table slds-table_bordered slds-max-medium-table_stacked slds-m-bottom_small edition"><colgroup><col></colgroup><tbody><tr class=""><td class="slds-cell-wrap" style="vertical-align:top;">Available in: both Salesforce Classic and Lightning Experience</td></tr></tbody><colgroup><col></colgroup><tbody><tr class=""><td class="slds-cell-wrap" style="vertical-align:top;">Available in: <strong>Enterprise</strong>, <strong>Unlimited</strong>, and <strong>Developer</strong> Editions.</td></tr></tbody></table>

<table class="slds-table slds-table_bordered slds-max-medium-table_stacked slds-m-bottom_small permission">
        <colgroup>
          <col style="width:50%">
          <col style="width:50%">
        </colgroup>
        <thead class="slds-text-title_caps ">
          <tr class="">
            <th scope="colgroup" class="slds-cell-wrap" colspan="2" style="text-align:center;vertical-align:top;" id="d6790e50">User Permissions Needed</th>
          </tr>
        </thead>
        <tbody>
          <tr class="">
            <td data-label="User Permissions Needed" class="slds-cell-wrap" style="vertical-align:top;" headers="d6790e50 ">To read, create, update, or delete external client apps:</td>
            <td class="slds-cell-wrap" style="vertical-align:top;" headers="d6790e50 ">
              <p>Customize Application AND either</p>
              <p style="margin-bottom:0;">Modify All Data OR Manage External Client Apps</p>
            </td>
          </tr>
          <tr class="">
            <td data-label="User Permissions Needed" class="slds-cell-wrap" style="vertical-align:top;" headers="d6790e50 ">To update all fields except Profiles, Permission Sets, and Service Provider
              SAML Attributes:</td>
            <td class="slds-cell-wrap" style="vertical-align:top;" headers="d6790e50 ">
              <p>Customize Application AND either</p>
              <p style="margin-bottom:0;">Modify All Data OR Manage External Client Apps</p>
            </td>
          </tr>
          <tr class="">
            <td data-label="User Permissions Needed" class="slds-cell-wrap" style="vertical-align:top;" headers="d6790e50 ">To update Profiles, Permission Sets, and Service Provider SAML
              Attributes:</td>
            <td class="slds-cell-wrap" style="vertical-align:top;" headers="d6790e50 ">Customize Application AND Modify All Data AND Manage Profiles and Permission
              Sets</td>
          </tr>
          <tr class="">
            <td data-label="User Permissions Needed" class="slds-cell-wrap" style="vertical-align:top;" headers="d6790e50 ">To rotate the consumer key and consumer secret:</td>
            <td class="slds-cell-wrap" style="vertical-align:top;" headers="d6790e50 ">Allow consumer key and secret rotation</td>
          </tr>
          <tr class="">
            <td data-label="User Permissions Needed" class="slds-cell-wrap" style="vertical-align:top;" headers="d6790e50 ">To install and uninstall external client apps:</td>
            <td class="slds-cell-wrap" style="vertical-align:top;" headers="d6790e50 ">
              <p>Customize Application AND either</p>
              <p style="margin-bottom:0;">Modify All Data OR Manage External Client Apps</p>
            </td>
          </tr>
          <tr class="">
            <td data-label="User Permissions Needed" class="slds-cell-wrap" style="vertical-align:top;" headers="d6790e50 ">To install and uninstall packaged external client apps:</td>
            <td class="slds-cell-wrap" style="vertical-align:top;" headers="d6790e50 ">
              <p>Download AppExchange Packages AND Customize Application AND either</p>
              <p style="margin-bottom:0;">Modify All Data OR
                Manage External Client Apps</p>
            </td>
          </tr>
        </tbody>
      </table>

For security, you must configure Salesforce to require either authentication or reCAPTCHA when your app submits user information to Headless Forgot Password API.

If you’re implementing the flow with a private client—also known as a web app with a backing server—we recommend that you always require authentication. With this requirement, when your app submits user information to the headless registration endpoint, you must include an access token issued to an integration user. To get the access token, use an internal integration user to complete an OAuth flow integrated with Salesforce, like the OAuth 2.0 user-agent flow. Make sure that you include the `forgot_password` scope when you complete this flow, either by configuring it on your external client app or passing it as a parameter. Save the access token from your response.

If you’re using the flow with a public client—also known as a single-page app—you must require reCAPTCHA. With this requirement, you must include a reCAPTCHA token in POST requests when your app submits user information to the Headless Registration API. To get a reCAPTCHA token, implement reCAPTCHA on your third-party app. For more information, see the reCAPTCHA documentation provided by [Google](https://developers.google.com/recaptcha).

To expand your email template options for the one-time password (OTP) email sent to end users during the flow, opt in to email template allowlisting and create an allowlist with custom templates. See [Use Multiple Email Templates for Headless Flows](https://help.salesforce.com/s/articleView?id=sf.headless_identity_email_template_allowlist.htm&language=en_US).

Before you start, create your external client app, complete its basic information. When you enable the necessary OAuth settings, add the **Access Headless Forgot Password API** (`forgot_password`) scope to the external client app.

After the external client app is set with the proper scope, take these steps to configure the Experience Cloud site for the Headless Forgot Password Flow.

1. From Setup, in the Quick Find box, enter Sites, and then select **All Sites**.
2. To access Experience Workspaces, next to your site name, click **Workspaces**.
3. Select **Administration**, and then select **Login & Registration**.
4. In the Headless Identity Configuration section, select **Allow password reset via the Headless Forgot Password Flow**.
5. To require an access token in your initial POST request, select **Require authentication to access this API**. We recommend that you always enable this setting for private clients, and that you never enable it for public clients.
6. To require a reCAPTCHA token in your initial POST request, select **Require reCAPTCHA to access this API**. We recommend that you always enable this setting for public clients. For private clients, you can optionally enable this setting, but it’s less critical than requiring authentication.
7. From the dropdown, select the maximum number of password reset attempts you allow before users must request a new OTP.
8. If you require reCAPTCHA, configure reCAPTCHA settings.
    
    1. For Secret Key, enter the secret key provided by Google in your reCAPTCHA API key pair.
    2. For Score Threshold, enter a threshold value between 0.5 and 1.
        
        If you’re using reCAPTCHA v3, this value determines the score that you accept. Scores closer to 0.5 are more likely to be bots, while scores closer to 1 are more likely to be valid users. For more information, see the [reCAPTCHA v3 documentation](https://developers.google.com/recaptcha/docs/v3).
    
    ![Note](https://sf-zdocs-cdn-prod.zoominsoftware.com/tdta-xcloud-identity-264-0-0-production-enus/699dab6f-8f1a-4662-b24f-6521d5b747f7/images/icon_note.png)
    
    Note If you require reCAPTCHA for the Headless Registration Flow, these settings also apply.
9. To opt in to email template allowlisting, select **Use only allowlisted email templates**.
10. Save your settings.
11. Depending on your email settings, configure an email template. If you selected **Use only allowlisted email templates**, this step is optional—Salesforce defaults to this email template if you don’t include an `emailtemplate` parameter in your request.
    1. From the Administration workspace, select **Emails**.
    2. For One-Time Password for Headless Forgot Password Flow, click ![Magnifying glass icon](https://sf-zdocs-cdn-prod.zoominsoftware.com/tdta-xcloud-identity-264-0-0-production-enus/699dab6f-8f1a-4662-b24f-6521d5b747f7/resources-global/_corporate/images/lookup.png).
    3. In the popup window that appears, select an email template.
    4. Save your changes.
    5. To customize the email, [edit its default content](https://help.salesforce.com/s/articleView?id=experience.networks_headless_registration_email.htm&type=5&language=en_US).