loading
Preparing LoginRadius developer resources
Mission: Help enterprises accelerate digital transformation with our fully-managed Customer IAM technology.
Skip to main content

Forgot Password

Collects the user's email, sends a password reset link via Send Suspended Email, validates the one-time token when the user clicks the link, then prompts for a new password and updates the account.
Recovery

How to import

In the Admin Console go to Workflows → New Workflow → From Template, select Forgot Password, and click Import.

Node Topology

User EntersForgot PasswordEmailOutputSend Suspended EmailTrueFalseReset PasswordPasswordOutputUpdate UserTrueFalseSuccessFailureFalse — error shown on form (retry)

How the Flow Works

  1. Entry: User Enters connects to the Forgot Password web page, which collects the user's email address.
  2. Email submitted: the Web Page Output feeds into Send Suspended Email (template type: Forgot Password). The node sends a password reset link to the provided email and waits for the user to click it.
  3. Link clicked: when the user opens the reset URL in their browser, the vtoken embedded in the link is automatically validated by the workflow.
  4. Send Suspended Email True: token valid; the flow shows the Reset Password web page where the user enters their new password.
  5. Send Suspended Email False: error (user not found, rate limit, blocked email, etc.); the flow loops back to the Forgot Password web page with an inline error.
  6. Password submitted: the Reset Password Web Page Output feeds into Update User, which persists the new password.
  7. Update User True: password updated; user is redirected to Success Final.
  8. Update User False: update failed; user is sent to Failure Final.

Nodes Used & Why

NodeRoleKey config
Forgot Password (Web Page)Collects the user's emailSet Web Page Header (e.g. "Forgot your password?")
Email (child)Input field for the email addressNo changes needed for most setups
Send Suspended EmailSends the reset link and validates the vtoken on clickSet Email Template Type = Forgot Password; configure Email Provider
Reset Password (Web Page)Collects the user's new password after token validationSet Web Page Header (e.g. "Set a new password")
Password (child)Input field for the new passwordEnable Confirm Password to require the user to re-enter
Update UserPersists the new password to the identity profileNo changes needed: reads new password from session
Success FinalTerminates on successful password resetSet Redirect URL to your post-reset destination (e.g. login page)
Failure FinalTerminates on update errorSet Redirect URL to a generic error page

Key Design Decisions

SEND SUSPENDED EMAIL FALSE LOOPS BACK TO THE FORM
Routing False back to the Forgot Password form lets users retry without restarting. Wire each error code from the property panel to the right destination: or leave them unhandled so they fall through to False and loop back.
User does not exist→ Loop to form (show generic message: see security note below)
User ID blocked→ Route to a dedicated blocked-account page
Email not allowed to register→ Loop to form with inline error
Email already exists→ Loop to form with inline error
Token limit reached→ Route to an error page with a cooldown message
REVEALING WHETHER AN EMAIL IS REGISTERED: ACCOUNT ENUMERATION
Different error messages for "email found" vs "email not found" allow attackers to enumerate valid accounts in your directory. Always show the same generic message regardless of whether the email exists.
"No account found for this email"  (reveals account existence)
"If this email is registered, a reset link has been sent"