I am trying to reset password from forgot password action using REST API:

[email protected]&

and I receive an email successfully to set new password as follow:

enter image description here

When click the button Set a New Password, I got this error

Your password reset link has expired

as follow :

enter image description here

when enter my email again in the last screen, I got another email to reset a new password as the first image, then click reset password and I can receive the proper screen and reset password function working fine as follow :

enter image description here

  • 1
    Did you find solution for this ? Commented Oct 9, 2019 at 11:13

5 Answers 5


First of all thanks @Shireen your comments help me to debug. I have kind of similar issue and it resolved not in the best way.


when you request reset password link via API, Magento creates DirectLink(Link with the query string, has 2 params) which are as follows.

please check this file /vendor/magento/module-customer/Controller/Account/CreatePassword.php

enter image description here and when you click the button on reset password email Magento try to access those query string params and get Failedenter image description here

due to they accessing the wrong param.

to overcome this problem quickly all you need to just replace param token with amp;token

I know this is not the solution, but you can at least start with this.

  • not working this Commented Oct 10, 2019 at 6:56

The default admin password reset email template has an error, (at least it does in my case on 2.3.5 Commerce), should be $user.user_id instead of $user.id.



{{store url="admin/auth/resetpassword/" _query_id=$user.id _query_token=$user.rp_token _nosid=1}}

Should be:

{{store url="admin/auth/resetpassword/" _query_id=$user.user_id _query_token=$user.rp_token _nosid=1}}

Easiest thing to do is copy this template into a new admin template (Marketing > Email Templates), make sure the user_id parameter is correct, and then assign it in Stores -> Configuration -> Admin -> Admin User Emails. Your password reset link should now have "id" and "token" query string parameters.


You are getting some magento exception. To check what is that exception, go to class method


and in catch statement log the exception like die($exception);

  • 1
    Thanks, This is the exception I got. How can I fix ? Magento\Framework\Exception\InputException: Invalid value of "0" provided for the customerId field. in /opt/bitnami/apps/magento/htdocs/vendor/magento/module-customer/Model/AccountManagement.php:933 Stack trace: #0 /opt/bitnami/apps/magento/htdocs/vendor/magento/module-customer/Model/AccountManagement.php(490): Magento\Customer\Model\AccountManagement->validateResetPasswordToken(0, '') #1 /opt/bitnami/apps/magento/htdocs/vendor/magento/module-customer/Controller/Account/CreatePassword.php(63)
    – Jsparo30
    Commented Feb 6, 2018 at 6:47
  • If you want to change the password of the customer by which you are logged in then you can also use this api - domain/index.php/rest/V1/customers/me/password? or also try passing customer id in the api which you are currently using or may be you are using the wrong email id
    – Shireen N
    Commented Feb 6, 2018 at 7:10
  • where I can pass the customer id ?
    – Jsparo30
    Commented Feb 6, 2018 at 7:12
  • Go to class method Magento\Customer\ModelAccountManagement::\initiatePasswordReset and print_r($customer->getData()) after line# 513. Check if you are getting any data, if not then you are using an email id which does not exists in magento DB
    – Shireen N
    Commented Feb 6, 2018 at 7:16
  • 1
    I am still facing the problem. Invalid value of "0" provided for the customerId field. can you help ?
    – Jsparo30
    Commented Feb 11, 2018 at 9:12

i recently encountered the similar issue :

Your password reset link has expired

I tried to create programmatically an admin user and sent a forgot password email with this method :


This is how I've created my use to avoid the issue :

$adminValues = [
    'username'         => $username,
    'firstname'        => $firstname,
    'lastname'         => $lastname,
    'email'            => $email,
    'password'         => $password,
    'interface_locale' => 'fr_FR',
    'is_active'        => 1,

try {
        $admin = $this->userFactory->create();
        $newResetPasswordLinkToken = $this->customerHelper->generateResetPasswordLinkToken();
    } catch (Exception $e) {

The method changeResetPasswordLinkToken() will set user rp_token data, which is mandatory when using your link from the forgot password email (template password_reset_confirmation.html).

This is called in Magento\User\Controller\Adminhtml\Auth\ResetPassword.php in _validateResetPasswordLinkToken(); where user rp_token data that you just set is compared to the one given by the email link.

I didn't see other answers to this issue, hope it will help !


I've had a similar problem. If you check the class AccountManagement (located: vendor/magento/module-customer/Model/AccountManagement.php).

You will find this was changed in 2.2.6. In my case an extension had copied the entire class to there extension which is now out of date and because of this throws an exception. Chances are that bitnami have done the same and they need to update there extension to be 2.2.6 compliant.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.