---
schema_version: "1"
id: 2470386a9e2e3510b7ebbe9a7130fc96f8096733bd8b335aac9e1524facb007a
title: "Headless Forgot Password Flow: Send a Password Reset Request"
collection: developer
version: current
locale: en-us
portal_url: https://docs.salesforce.com/developer/current/en-us/security/headless-identity-impl-guide/guides/headless-identity/headless-identity-postman-forgotpassword-initialize.md
canonical_url: https://developer.salesforce.com/docs/platform/headless-identity-impl-guide/guide/headless-identity-postman-forgotpassword-initialize.html
source_site: developer.salesforce.com
content_type: documentation
content_hash: 97663812e1dcd184bcf23de791cbff9b79e8338f56d097e263bc94d67f31aef0
products:
  - Headless Identity Implementation Guide
  - Security
---

# Headless Forgot Password Flow: Send a Password Reset Request

To initialize the Headless Forgot Password Flow, send a password reset request. This example walks you through sending a request with Postman.

|Required Editions|
|-----------------|
|Available in: both Salesforce Classic (not available in all orgs) and Lightning Experience|
|Available in: **Enterprise**, **Unlimited**, and **Developer** Editions|

1.  From the Headless Identity API Demo folder in Postman, select **Forgot Password - Initialize**.

    Note the location of the POST request. It’s the `/services/auth/headless/forgot_password` endpoint on your Experience Cloud site.

2.  To see the request body, click **Body**. The password reset request includes these parameters.


    -   `username`—The user’s registered username
    -   `recaptcha`—A reCAPTCHA token. Because you configured your flow to require reCAPTCHA , you must include this parameter.
3.  Replace the body parameter values with your own information.


    1.  For `username`, enter the username that you registered and logged in with.

    2.  For `recaptcha`, enter a valid reCAPTCHA token from Google. You get this token when you implement reCAPTCHA on your app.

4.  To send the request to Headless Forgot Password API, click **Send**.

    If the request is successful, Salesforce sends a one-time password (OTP) to your email address. Here’s an example response in Postman. To avoid leaking user information, Salesforce always returns this response if reCAPTCHA validation succeeds, even if the user doesn’t exist.

    ```nolang
    {
        "status_code": "otp_sent"
    }
    ```

5.  Check your email to confirm that you received the OTP.


Next, use the OTP to finish changing your password.