# Okta API - Credential operations via OAuth2 token **URL:** \ **Category:** OAuth/OIDC\ **Tags:** api\ **Created:** [June 18, 2020, 5:20am UTC](https://devforum.okta.com/t/okta-api-credential-operations-via-oauth2-token/9840 "2020-06-18T05:20:28Z")\ **Posts on this page:** 3\ **Page:** 1
**Author:** ![mana](https://avatars.discourse-cdn.com/v4/letter/m/e9bcb4/32.png) [@mana](https://devforum.okta.com/u/mana)\ **Post date:** [June 18, 2020, 5:20am UTC](https://devforum.okta.com/t/okta-api-credential-operations-via-oauth2-token/9840/1 "2020-06-18T05:20:28Z")
Hi, I am trying to change a user´s password via the okta API: [Users | Okta Developer](https://developer.okta.com/docs/reference/api/users/#change-password) I was trying to access the api via the accessToken that I received by the user´s login. But as I read it seems that the API for all Credential operations is still not available via bearer tokens. Instead we should use an extra SSWS Api token, generated in the admin console. As I understand, it is not recommended to keep the api token in the client (SPA) because of security reasons. But do I really have to implement an server proxy endpoint doing this? Is there a better way doing this or when will this be supported by default accessTokens we already get by the logged in users? Thanks, Mana ---
**Author:** ![dawoudt](https://avatars.discourse-cdn.com/v4/letter/d/ecb155/32.png) [@dawoudt](https://devforum.okta.com/u/dawoudt)\ **Post date:** [December 8, 2022, 6:48am UTC](https://devforum.okta.com/t/okta-api-credential-operations-via-oauth2-token/9840/2 "2022-12-08T06:48:41Z")
Hi @mana the sign in widget provide a link for customers to reset their password. ---
**Author:** ![andrea](https://sea1.discourse-cdn.com/oktadev/user_avatar/devforum.okta.com/andrea/32/2172_2.png) [@andrea](https://devforum.okta.com/u/andrea)\ **Post date:** [February 13, 2024, 12:12am UTC](https://devforum.okta.com/t/okta-api-credential-operations-via-oauth2-token/9840/3 "2024-02-13T00:12:23Z")