Appearance
Password reset flow (web)
The web reset is a link, not a code. resetPassword emails the customer a link to the storefront's /reset-password page carrying a passwordToken; that page posts the new password to changePassword.
Play the flow
shop.example.com/login
shop · rewards · scan
log in
email
password
email me a code
email me a link
forgot password?
Page not designed yet — drawn from what the documented flow requires.
States
This journey is one path through the authentication statechart, which traces every edge to code.
changePassword stores the password and returns a message — not a session. The customer logs in again, and a password login still requires a verified account: a reset does not verify one. See Lifecycle.
API calls by stage
| Stage | Action | API call | Access |
|---|---|---|---|
| 1 | Ask for a link | POST /api/v1/resetPassword — email, or phoneNumber + phone_prefix | Origin + Brand key |
| 2 | Open /reset-password?passwordToken=… | No call — the storefront reads the token from its URL | — |
| 3 | Save the new password | POST /api/v1/changePassword/:passwordToken — password, minimum 8 | Origin |
| 4 | Log in | POST /api/v1/login | Origin + Brand key |
What the API forces onto this page
- An unknown address is not silent.
resetPasswordanswers with a message telling the customer to register. The page can show it, or replace it with a neutral "if that address has an account…" message. - Confirming the password is the page's job.
changePasswordtakes onepassword. - The link's path is fixed by the backend as
/reset-passwordon the storefront, so the storefront must serve that route.