Password Reset VIA API

[wellconnit]

Hi All,

Has anyone successfully worked out a way to generate a forgotten password email from the WHMCS API?

 

It's all good to be able to login to the system but if the user has forgotten their password it's pointless getting them to sign into the WHMCS version of the site when you're using the API to make sure they don't hit that site in the first place?

It seems strange that this isn't native to WHMCS already as it aligns with the login process of the normal page?

Any help with this is greatly appreciated..

 

Thanks!

[inteldigital]

Hi @wellconnit,

Maybe this thread will be of interest to you:

Change client's password using API

You should also take a further look at the API documentation:

API - WHMCS Developer Documentation

Edited May 7, 2018 by inteldigital
Adding API ref.

[wellconnit]

1 hour ago, inteldigital said:

Hi @wellconnit,

Maybe this thread will be of interest to you:

Change client's password using API

You should also take a further look at the API documentation:

API - WHMCS Developer Documentation

Hi Intel,

 

That's of no help whatsoever?.

 

What part out of the two posts are going to assist with making a Forgot Password method?

[inteldigital]

Well, I'm assuming:

UpdateClient

You would have to ask someone more knowledgable than I, but I'm assuming you could then send an email to the client email on file with:

SendEmail

Just my two cents.

[wellconnit]

10 hours ago, inteldigital said:

Well, I'm assuming:

UpdateClient

You would have to ask someone more knowledgable than I, but I'm assuming you could then send an email to the client email on file with:

SendEmail

Just my two cents.

Yeah you could, however if someone was to type in an email address of someone that had an account it would reset their password without them actually requesting it,

 

The UpdateClient API method will allow you to update a password, but won't let you send a verification email to check that it's actually the owner of the email address that has requested the password reset in the first place, which rules that process out.

 

Unfortunately not a viable solution.

[inteldigital]

Interesting. Maybe @brian! has some answers?

[brian!]

7 hours ago, inteldigital said:

Interesting. Maybe @brian! has some answers?

@inteldigital - SendEmail would be the obvious way, but it's coded to prevent sending the password templates - I assume for security reasons...

Quote

The following email templates cannot be sent in this way:

• Automated Password Reset
• Password Reset Confirmation
• Password Reset Validation

to be honest, I don't know the answer to the question.

[inteldigital]

4 minutes ago, brian! said:

@inteldigital - SendEmail would be the obvious way, but it's coded to prevent sending the password templates - I assume for security reasons...

to be honest, I don't know the answer to the question.

I did notice that in the documentation, but I figured they may have been some secret to getting it done. Surely the API is secure enough to send those kinds of emails? I mean, if anything, doing things through the API should be more secure than an physical user logging in and doing it, no?