# MyProfile Replace Password not enabled

**URL:** <https://devforum.okta.com/t/myprofile-replace-password-not-enabled/34345>\
**Category:** API\
**Tags:** myaccount\
**Created:** [September 26, 2025, 3:46pm UTC](https://devforum.okta.com/t/myprofile-replace-password-not-enabled/34345 "2025-09-26T15:46:55Z")\
**Posts on this page:** 7\
**Page:** 1

<div class="post-metadata">

**Author:** ![gze](https://avatars.discourse-cdn.com/v4/letter/g/8491ac/32.png) [@gze](https://devforum.okta.com/u/gze)\
**Post date:** [September 26, 2025, 3:46pm UTC](https://devforum.okta.com/t/myprofile-replace-password-not-enabled/34345/1 "2025-09-26T15:46:55Z")

</div>

I logged into the org server for a user on a native app, and have attempted to use that to update the password ([Password](https://developer.okta.com/docs/api/openapi/okta-myaccount/myaccount/tag/Password/#tag/Password/operation/updatePassword)) of the user. I have the right scope granted and have checked to make sure my JWT has the right scope as well.

Whenever I try to then update the password I get an error telling me that the feature is not enabled. I am currently trying to implement this on the free integrator plan before we swap over to a paid plan. Looking through the settings I am not really sure what feature has to be enabled or if this is just not something which can be done on the free integrator plan. I have noticed that the “Replace a Password” API does work, so I am a bit confused as to why update password isn’t working too. I can’t even see the password complexity through the API since that is also a disabled feature apparently.  
I have scoured the documentation for some reasoning behind the issue, but it isn’t clear to me what it is.

---

<div class="post-metadata">

**Author:** ![andrea](https://sea1.discourse-cdn.com/oktadev/user_avatar/devforum.okta.com/andrea/32/2172_2.png) [@andrea](https://devforum.okta.com/u/andrea)\
**Post date:** [September 26, 2025, 9:57pm UTC](https://devforum.okta.com/t/myprofile-replace-password-not-enabled/34345/2 "2025-09-26T21:57:52Z")

</div>

Can you share some more details about how you attempted to make this request? I was able to test it myself with an access token granted the okta.myAccount.password.manage scope using the following:

```auto
curl --location 'https://{{oktaDomain}}/idp/myaccount/password/change-password' \
--header 'Accept: application/json; okta-version=1.0.0' \
--header 'Authorization: Bearer {{accessToken}}' \
--header 'Content-Type: application/json' \
--data '{
    "oldPassword": "oldPassword123!",
    "newPassword": "newPassword123!"
}'

```

---

<div class="post-metadata">

**Author:** ![gze](https://avatars.discourse-cdn.com/v4/letter/g/8491ac/32.png) [@gze](https://devforum.okta.com/u/gze)\
**Post date:** [September 29, 2025, 3:33pm UTC](https://devforum.okta.com/t/myprofile-replace-password-not-enabled/34345/3 "2025-09-29T15:33:54Z")

</div>

I tried again in curl replacing the relevant parts with my Okta domain and access token and I get the same error:

```auto
{
  "errorCode": "E0000015",
  "errorSummary": "You do not have permission to access the feature you are requesting",
  "errorLink": "E0000015",
  "errorId": "oae_kPB98MwQX6cziTUl8Jnxg",
  "errorCauses": []
}

```

The access token contains the correct scope otherwise I’d get an error referring to the scope not being granted:

```auto
"scp": [ 
"openid",
"okta.myAccount.password.manage", 
"okta.myAccount.password.read"
],

```

I logged into the Org authorization server for our Okta domain which uses OIDC and MFA. Once logged in I am sending a post request to change-password as you have already shown. I have double checked the header contents, but obviously that is not the issue here.  
The 401 error I have provided above is returned.

I had seen this issue in the past posts when this was an early feature, but it is really strange that I am encountering it despite the feature, to my knowledge, not requiring anything to be enabled besides granting the correct scope. Is there any other info I can provide you that would help you discover the source of the issue? It seems to be pointing at some setting in Okta, and not the request, being the problem.

---

<div class="post-metadata">

**Author:** ![andrea](https://sea1.discourse-cdn.com/oktadev/user_avatar/devforum.okta.com/andrea/32/2172_2.png) [@andrea](https://devforum.okta.com/u/andrea)\
**Post date:** [September 29, 2025, 3:39pm UTC](https://devforum.okta.com/t/myprofile-replace-password-not-enabled/34345/4 "2025-09-29T15:39:27Z")

</div>

Can you check if you have the feature “End User Settings version 2.0” enabled in your org? If not, can you enable this feature (you should see it under Settings → Features) and retry?

---

<div class="post-metadata">

**Author:** ![gze](https://avatars.discourse-cdn.com/v4/letter/g/8491ac/32.png) [@gze](https://devforum.okta.com/u/gze)\
**Post date:** [September 29, 2025, 3:53pm UTC](https://devforum.okta.com/t/myprofile-replace-password-not-enabled/34345/5 "2025-09-29T15:53:24Z")

</div>

Great! That fixed it. How was I supposed to know to enable this? I don’t see it mentioned anywhere.  
It would be helpful to provide this in the developer documentation ([MyAccount API](https://developer.okta.com/docs/api/openapi/okta-myaccount/guides/overview/)) under the MyAccount API or in some place which would make this clear to others. I had originally looked to enable “IDP MyAccount Password API” in the features panel because of this page ([Okta Help Center (Lightning)](https://support.okta.com/help/s/article/add-okta-api-scope-okta-myaccount-password-manage?language=en_US)) and didn’t see it, so I assumed nothing needed to be changed there.

---

<div class="post-metadata">

**Author:** ![andrea](https://sea1.discourse-cdn.com/oktadev/user_avatar/devforum.okta.com/andrea/32/2172_2.png) [@andrea](https://devforum.okta.com/u/andrea)\
**Post date:** [September 30, 2025, 3:20pm UTC](https://devforum.okta.com/t/myprofile-replace-password-not-enabled/34345/6 "2025-09-30T15:20:13Z")

</div>

Yeah, I didn’t realise that feature was required either. I am however working on getting an article published that will explain this

---

<div class="post-metadata">

**Author:** ![system](https://global.discourse-cdn.com/oktadev/original/1X/589c4c5f80de422d01f47cee7185a7fb8227835c.png) [@system](https://devforum.okta.com/u/system)\
**Post date:** [October 1, 2025, 3:20pm UTC](https://devforum.okta.com/t/myprofile-replace-password-not-enabled/34345/7 "2025-10-01T15:20:20Z")

</div>

This topic was automatically closed 24 hours after the last reply. New replies are no longer allowed.