Turn Off Forgot Password

Turn off the forgot password workflow when users must recover accounts another way, for example through your support team or a corporate identity provider. FusionAuth turns the workflow off for each TenantA logical container for Users, Applications, and settings that is isolated from other Tenants., not for each ApplicationA software program that your users log in to through FusionAuth..

Remove the Forgot Password Templates#

The Tenant's forgot password templates turn the workflow on. To turn off the workflow:

1. Navigate to Tenants and click next to your Tenant.
2. Select the Identities tab.
3. In the Template settings section, set Forgot password in the email column to Feature disabled. No template selected.
4. Set Forgot password in the phone column to the same value.
5. Click .

To turn off only one delivery method, clear only that template. For example, clear the phone template to stop recovery by text message and keep recovery by email.

An Application's own Forgot password templates don't turn the workflow back on. FusionAuth checks only the Tenant templates.

Hide the Forgot Password Link#

The login page shows the Forgot your password? link even after you remove the templates. A user who clicks the link sees Forgot password handling is not enabled. Please contact your system administrator for assistance. To hide the link, edit an advanced theme:

1. Navigate to Customizations -> Themes and click next to the theme your Application uses.

2. Select the OAuth authorize template.

3. Delete the line that links to /password/forgot:

   [@helpers.link url="${request.contextPath}/password/forgot"]${theme.message("forgot-your-password")}[/@helpers.link]
   

4. Click .

The Simple Theme Editor can't remove the link. To change the message instead, set the [ForgotPasswordDisabled] key on the theme's Messages tab. See Theme Localization.

What Still Works#

With the templates removed, the Forgot Password API returns 403 to any request that asks FusionAuth to send a message. The Admin UI also hides the Send password reset action for the Tenant's users.

A request with an API key and sendForgotPasswordMessage set to false still creates a change password Id. Limit which API keys can call /api/user/forgot-password. See API Key Authentication.

Users can still change a known password in self-service account management. An administrator can still require a password change at the next login.

Confirm the Change#

To confirm that the workflow is off:

1. Open the login page for your Application in a private browser window.
2. Confirm that the Forgot your password? link doesn't appear.
3. Open /password/forgot?client_id={yourClientId} and submit the email address of a test user.
4. Confirm that the page shows the Forgot password handling is not enabled. message.