I have picked up some work on a headless Drupal 7 site, using services, and service_token.

Where the "normal" service login, as I understand it, uses a cookie to authenticate, Services Token allows authentication by passing a token as the username in a basic auth header.

All appears to work well. But I have been asked to implement "Forgot password", and I am struggling to understand how that flow fits with Services Token.

Any guidance most appreciated.

3 Answers 3


In Drupal 8 you can reset it by

curl  POST 'http://YOUR_SITE.URL/user/password?_format=json' \
--header 'Content-Type: application/json' \
--header 'Content-Type: application/json' \
--data-raw '{
    "mail": "USER_EMAIL"
  • { "message": "No route found for \"POST /user/password\"" } Jan 13, 2021 at 9:00
  • @YogeshKushwaha , please change "YOUR_SITE.URL" with your drupal site URL.
    – Yuseferi
    Jan 13, 2021 at 16:34
  • Could you please explain bit more as I don't find this url in REST UI and that's why no route found error exist. I am replacing the YOUR_SITE.URL with my site url. Do I need to install any module or it is in Drupal core? I am using Drupal 8.9.10 Jan 27, 2021 at 13:20

It's already built into the Services module, just enable its corresponding resource then do a POST ?q=[my-endpoint]/user/request_new_password.json and send along a name, e.g.: name=john or an e-mail address: [email protected]

  • Thanks Tyler, I have done that. And I have it working with the normal login flow. But the site makes use of services_token, and I can't get it to work with that... Am I missing something? Aug 30, 2016 at 11:02
  • I haven't used that module, but perhaps just add the token to the URL query string: ?q=[my-endpoint]/user/request_new_password.json&token=abcdefg&name=john Aug 30, 2016 at 13:00

The solutions, a custom endpoint that takes the token as a password.

The problem we had was that the standard services authentication flow relies on cookies and that is a problem/pain when working with AngularJS (apparently).

Hence the use of service_token. An update to the two modules allowed for most of the login and forgot password flow. service_token for auth, and services for forgot password.

To handle the reset (noting that this was not a production site and this was not the most robust of solutions), we added a custom endpoint that took the service_token token as the "current password"

Hope that is of help to others.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.