Password Reset
Request and process password resets.
Updated
On this page
Overview
Customers who have set a password can reset it if forgotten. The flow uses a secure OTP code sent to their email address.
Request Password Reset
Send a reset code to the customer's email:
import dash from "@/lib/dash"
await dash.auth.requestPasswordReset("customer@example.com")
// An OTP code is sent to the email
Note: This endpoint always returns success, even if the email doesn't exist. This prevents email enumeration attacks.
Reset the Password
After the customer enters the code and a new password:
await dash.auth.resetPassword({
email: "customer@example.com",
code: "592038",
password: "newSecurePassword456!",
})
// Password is updated — customer can now log in with the new password
REST API Endpoints
| Action | Method | Endpoint |
|---|---|---|
| Request Reset | POST | /storefront/auth/forgot-password |
| Reset Password | POST | /storefront/auth/reset-password |
Request Body — Forgot Password
{
"email": "customer@example.com"
}
Request Body — Reset Password
{
"email": "customer@example.com",
"token": "592038",
"new_password": "newSecurePassword456!"
}
Example Reset Form
"use client"
import { useState } from "react"
import dash from "@/lib/dash"
export function ResetPasswordForm() {
const [step, setStep] = useState<"email" | "code">("email")
const [email, setEmail] = useState("")
async function requestReset() {
await dash.auth.requestPasswordReset(email)
setStep("code")
}
async function submitReset(code: string, password: string) {
await dash.auth.resetPassword({ email, code, password })
// Redirect to login
}
// ... render form based on step
}
Alternative: OTP Login
Customers can always bypass password reset entirely by using OTP login. If a customer forgets their password, they can simply request an OTP to log in and then set a new password from their account.
Next Steps
- Login / Logout — All login methods
- Profile Management — Update profile after logging in