--- schema_version: "1" id: da95540447ff658eba808ffb464b50c689fd5dbd9fd66240038d76cd6f788659 title: Password Reset with Callback URI collection: developer version: current locale: en-us portal_url: https://docs.salesforce.com/developer/current/en-us/commerce-cloud/commerce-api/guides/slas-password-reset.md canonical_url: https://developer.salesforce.com/docs/commerce/pwa-kit-managed-runtime/guide/slas-password-reset.html source_site: developer.salesforce.com content_type: documentation content_hash: 839b042e6eb56b94414f8b39eb688a91a62b3e3168afe42f88507020790b8669 products: - Composable Storefront - Salesforce APIs --- # Password Reset with Callback URI Learn to implement password reset for B2C Commerce with the Shopper Login and API Access Service (SLAS). This allows shoppers to update their passwords and keep their accounts secure. The password reset flow for both public and private clients uses two SLAS endpoints, one to get a password reset token and one to reset the password using the token. The two SLAS endpoints, [`shopper-login:getPasswordResetToken`](https://developer.salesforce.com/docs/commerce/commerce-api/references/auth?meta=getPasswordResetToken) and [`shopper-login:resetPassword`](https://developer.salesforce.com/docs/commerce/commerce-api/references/auth?meta=resetPassword), provide a callback URL for the SLAS service to send the password reset token. SLAS password reset tokens expire after 10 minutes. ## Overview 1. Set up a publicly accessible callback URL to receive webhook requests from the SLAS service and send reset tokens to shoppers via email, SMS, or other means. 2. Configure your SLAS Client with that callback URL. 3. Generate a unique code challenge and code verifier. 4. Create a reset form that calls `shopper-login:getPasswordResetToken` with your callback URL, beginning the process. 5. To avoid the need for a PKCE code_challenge or code_verifier, use the `hint` query parameter with a value of `cross_device`. 6. Create an update form that the shopper arrives at following the link your server sent them. The shopper provides their new password as well as the token, and their password is updated. They can then login using their new password. ## Prerequisites - A publicly accessible callback URL, such as an ECOM instance, Managed Runtime environment, or your own server. **tip:** If you don't currently have a callback URL, use a public service such as [Webhook.site](https://www.webhook.site) for testing purposes. - A SLAS Client configured with your callback URL. ## SLAS Password Reset Flow 1. Call the SLAS endpoint `shopper-login:getPasswordResetToken` to begin the password reset process. 1. Provide your publicly accessible `callback_uri` that receives the webhook request from the SLAS web service with the password reset payload. 2. The `callback_uri` is validated against the SLAS Client's allowed callback URLs. 3. If the `callback_uri` is valid, SLAS sends a POST request to the callback URL with the password reset token, for example: ```json { "email_id": "shopper@example.com", "login_id": "shopper@example.com", "phone": "123-555-1212", "customer_id": "abq96kjBGjQhBEgYHNWmemnL8l", "token": "95107856" } ``` - The SLAS web service makes an HTTP POST request with `Content-Type: application/json` to your callback URL. The payload contains the `token`, which is an eight-digit numeric value needed to reset the password, along with potential ways to contact the shopper, including the email address and phone number associated with their profile if available. Commonly, the shopper’s `email_id` and `login_id` is the same, but in B2C Commerce, it is possible for a shopper's email address to be different than the value they use to log in, which is the `login_id`. 4. The server hosting the callback URL sends the token to the shopper via email, SMS, or other means. Typically the token is sent as part of a link that a shopper can click or as a value that the shopper needs to enter in a form. 5. The shopper provides the token to the SLAS endpoint `shopper-login:resetPassword` along with their new password to complete the process. **note:** The new password must meet password complexity requires set on the B2C Commerce site, otherwise the request is rejected. ![SLAS password reset login process without PKCE](https://developer.salesforce.com/docs/media/commerce-api/slas-password-reset-login-flow-non-pkce.png) ## Validate the Callback Payload Refer to the steps in [Verify SLAS Callback Requests](https://developer.salesforce.com/docs/commerce/pwa-kit-managed-runtime/guide/slas.md#verify-the-slas-password-action-callback). ## Examples To reset a password both public and private clients, two separate requests are made: 1. Request a password reset token. 2. After the reset token is provided by the customer, request a password reset using the reset token. ### SLAS Public Client 1. Request a password reset token: ```bash curl --location 'https://{shortCode}.api.commercecloud.salesforce.com/shopper/auth/v1/organizations/bgvn_stg/oauth2/password/reset' \ --header 'Content-Type: application/x-www-form-urlencoded' \ --data-urlencode 'user_id=darth.vader' \ --data-urlencode 'mode=callback' \ --data-urlencode 'channel_id=SiteGenesis' \ --data-urlencode 'client_id={public_client_id}' \ --data-urlencode 'callback_uri=http://localhost:9003/callback' \ --data-urlencode 'hint=cross_device' ``` 2. After the reset token is provided by the customer, request a password reset using the reset token: ```bash curl --location 'https://{shortCode}.api.commercecloud.salesforce.com/shopper/auth/v1/organizations/bgvn_stg/oauth2/password/action' \ --header 'Content-Type: application/x-www-form-urlencoded' \ --data-urlencode 'pwd_action_token=60045027' \ --data-urlencode 'client_id={public_client_id}' \ --data-urlencode 'user_id=darth.vader' \ --data-urlencode 'new_password={new_password}' \ --data-urlencode 'channel_id=SiteGenesis' ``` ### SLAS Private Client 1. Request a password reset token: ```bash curl --location 'https://{shortCode}.api.commercecloud.salesforce.com/shopper/auth/v1/organizations/bgvn_stg/oauth2/password/reset' \ --header 'Content-Type: application/x-www-form-urlencoded' \ --header 'Authorization: {base64_client_credentials} \ --data-urlencode 'user_id=darth.vader' \ --data-urlencode 'mode=callback' \ --data-urlencode 'channel_id=SiteGenesis' \ --data-urlencode 'callback_uri=https://localhost:9010/callback' \ --data-urlencode 'hint=cross_device' ``` 2. After the reset token is provided by the customer, request a password reset using the reset token: ```bash curl --location 'https://{shortCode}.api.commercecloud.salesforce.com/shopper/auth/v1/organizations/bgvn_stg/oauth2/password/action' \ --header 'Content-Type: application/x-www-form-urlencoded' \ --header 'Authorization: {base64_client_credentials}' \ --data-urlencode 'pwd_action_token=19362888' \ --data-urlencode 'user_id=darth.vader' \ --data-urlencode 'new_password=Salesforce3!' \ --data-urlencode 'channel_id=SiteGenesis' ``` ## Constraints Your callback URL _must_ be accessible to the SLAS webservice. That means it cannot use an authentication mechanism for incoming requests. As a specific example, you can’t use B2C Commerce Storefront Protection with SLAS Password Reset.