I am using OCAPI for SFCC (Ver 21.10) . I have a use case where a user needs to initiate a password reset from a headless frontend. I am therefore trying to find all the APIs that participate in the complete process.

SO far , i followed this link to dispatch an Email with the token . This is basically about calling the /customers/{customer_id}/password_reset endpoint and using a hook to dispatch the email. This part is clear.

The question is : once i receive the token, which API should i use to actually reset the password ?

I have attempted multiple end point such as /customers/password_reset AND customers/{customer_id}/password but with no success.

Thanks in advance for your help.


1 Answer 1


Turns out it is a simple as using the beforePost hook of the customer/auth API. The example implementation is listed below :

exports.beforePOST  = function beforePOST(authorizationHeader, authRequestType) {
    var Status = require('dw/system/Status');
    var Transaction = require('dw/system/Transaction');
    if (authRequestType.displayValue === 'credentials') {
        // we cant change the body, so we can either have get parameters or custom headers
        var resetToken = request.httpHeaders.get('x-pw-reset-token');               
        if (resetToken) {           
            var userName;
            var password;

            var baseAuth = authorizationHeader.substr(6);
            var base64decoded = dw.util.StringUtils.decodeBase64(baseAuth, 'UTF-8');

            [userName, password] = base64decoded.split(':');

            var customer = dw.customer.CustomerMgr.getCustomerByLogin(userName);
            var credentials = customer.profile.credentials;
            var status = credentials.setPasswordWithToken(resetToken, password);
            if (status.error) {
                return status;

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .