Introduction
Password reset functionality is an essential feature in many login-based applications. When users forget their password, the application should provide a secure way to verify their identity and allow them to create a new password.
In this project, I built and tested a simple Password Reset API using Python Flask and Postman.
API Flow
The complete password reset process follows this flow:
Forgot Password → Email Verification → OTP Generation → OTP Verification → New Password → Password Reset
Technologies Used
Python
Flask
Postman
Random module
Project Structure
Password_Reset_API/
│
├── venv/
│
└── app.py
The app.py file contains the complete Password Reset API logic.
Step 1: Forgot Password API
Endpoint
POST /forgot-password
URL
http://127.0.0.1:5000/forgot-password
Request Body
{
"email": "test@gmail.com"
}
How It Works
When the user enters their email:
The API checks whether the user exists.
If the email is registered, a 6-digit OTP is generated.
The OTP is temporarily stored.
The API returns the generated OTP.
Successful Response
{
"message": "OTP generated successfully",
"email": "test@gmail.com",
"otp": 239753
}
The OTP will be different each time the API is called.
Step 2: Reset Password API
Endpoint
POST /reset-password
URL
http://127.0.0.1:5000/reset-password
Request Body
{
"email": "test@gmail.com",
"otp": 239753,
"new_password": "NewPassword@123"
}
The API then:
Checks whether the user exists.
Checks whether an OTP was generated.
Verifies the entered OTP.
Updates the user's password.
Deletes the OTP after successful use.
Successful Response
{
"message": "Password reset successfully"
}
Status Code:
200 OK
Error Cases Handled
User Not Found
{
"message": "User not found"
}
Status Code:404
OTP Not Generated
{
"message": "OTP not generated"
}
Status Code: 400
Invalid OTP
{
"message": "Invalid OTP"
}
Status Code: 400
Issues I Encountered During Testing
While testing the API, I faced a 404 Not Found error because the Flask server was started before all API routes were defined.
The solution was to place:
if name == 'main':
app.run(debug=True)
at the end of the file, after defining all API routes.
I also encountered an invalid JSON error when using:
"otp": YOUR_OTP
The correct approach was to replace YOUR_OTP with the actual numeric OTP generated by the Forgot Password API.
Final Result
After correcting the route issue and using the correct OTP, the Password Reset API worked successfully.
The final response was:
{
"message": "Password reset successfully"
}
with:
200 OK
What I Learned
Through this project, I learned how to:
Build REST APIs using Flask
Create and test API endpoints
Handle JSON requests and responses
Generate a 6-digit OTP
Temporarily store and verify OTPs
Update user passwords
Handle error responses
Test APIs using Postman
Future Improvements
For a production-level Password Reset API, I would like to add:
Database integration
Password hashing
OTP expiration time
Email delivery for OTPs
Secure token generation
Rate limiting
JWT authentication
Password strength validation
HTTPS security
Conclusion
This project helped me understand the practical workflow of API development and testing using Flask and Postman.
The current project is a basic learning and testing implementation, but it can be improved further by adding advanced security and database features.
Thank you for reading!
Top comments (0)