yc954 (yc954) asked a question.
We are integrating OKTA authentication into our platform and need clarification on the password recovery process:
Forgot Password Flow:
When a user clicks "Forgot Password," our platform calls the /api/v1/authn/recovery/password endpoint, and a reset link is sent to the user's email or SMS. In the "Forgot Password" request, can we set both email and SMS as factorType simultaneously, or do we need to call the recovery password API separately for each factorType ?
Does OKTA require an external telephony service provider (TPS) to send the reset password link via SMS, or does OKTA handle SMS notifications internally?
Any insights or best practices on handling password recovery efficiently would be greatly appreciated. Thanks in advance!
Hi @yc954 (yc954) , Thank you for reaching out to the Okta Community!
The requests will have to be sent separately.
Example:
Also, Okta no longer provides out-of-the-box telephony services. You will need to look into the "Bring Your Own Telephony Required for SMS and Voice" options.
If my answer helped, remember to mark it as best to increase its visibility for other members of the Okta Community who might have the same questions as you.
Hope my answer helps!
--
Help others in the community by liking or hitting Select as Best if this response helped you.
Level up your Identity security superpowers with Okta Learning.
Join the Online Discussion for Ask me Anything on March 25, 2025: Identity Threat Protection with Okta AI