How to Modify the Reset Password Link Lifespan
Last Updated:
Overview
Okta hardcodes the lifespan of the password reset link to one hour in the Admin Console. Administrators cannot modify this lifespan through the user interface. Modify the password reset link lifespan by updating the password policy via an API call. When an administrator accesses an Okta user profile, selects the Reset or Remove password button, and chooses the Send a reset password email option, Okta sends an email with a password reset link that expires based on this configured lifespan.
The Okta Admin Console displays the user profile options to reset a password.
The Okta Admin Console displays the prompt to send a password reset email.
Applies To
- Okta Identity Engine (OIE)
- Password reset link lifespan
Solution
Note: The following is provided as an example. Okta recommends testing this in a test or preview environment before deployment into a production environment.
In Okta Identity Engine (OIE), the only method to change the lifespan of the password reset link is through an API call.
What steps modify the password reset link lifespan?
Update the password reset link lifespan by identifying the target password policy in the Okta Admin Console, retrieving the policy ID via an API client, and sending a request to update the token lifetime parameter.
- Access the Authenticators section of the Okta Admin Console, select Actions, and then choose Edit.
- Under the Add New Password Policy button, search for the password policy that requires modification and record the name of the policy.
The Okta Admin Console displays the configured password policies under the Authenticators section. - Configure an API client tool (for example, Postman) with the Okta REST API and the Policies API Reference collection.
- In the API client, access the Policy collection, navigate to the Password folder, select the Retrieve a Policy option, and send the request. In the received API response, search for the password policy name and copy the policy ID value.
The API client displays the JSON response containing the policy ID required for the update. - In the API client, navigate to the Password folder and select Retrieve a Policy. In the API endpoint field, replace the
{{policyId}}variable with the policy ID value copied earlier, and send the request. Copy the entire response body.
The API client displays the GET request used to retrieve the specific policy details. - In the API client, navigate to the Password folder and select the Replace a Policy option. In the API endpoint field, add the policy ID obtained earlier. Access the Body tab and replace the existing content with the API response copied from the previous step. Do not send the request yet.
- Locate the
"tokenLifetimeMinutes"parameter in the JSON body. This parameter manages the lifespan of the password reset link.
The JSON body contains the tokenLifetimeMinutes parameter that controls the password reset link lifespan. - Change the
"tokenLifetimeMinutes"value to the required lifespan in minutes. Do not make any other changes to the JSON body.
The JSON body reflects the updated tokenLifetimeMinutes value before sending the PUT request. - Send the request to update the policy.
- Verify the update by executing the Retrieve a Policy request again and confirming the updated value in the response.
The API client displays the successful GET request confirming the updated tokenLifetimeMinutes value.
NOTE: Okta does not support displaying the lifespan of the password reset link in minutes, only in hours. The user interface does not display minute values that do not represent whole hours (for example, 70, 99, or 135 minutes). Okta recommends setting this value in whole hours (for example, 60, 120, or 180 minutes) to avoid confusion. The tokenLifetimeMinutes minimum is 60 minutes, and the maximum is 300000 minutes.
