# Password Reset | Angular | Password Flow **URL:** \ **Category:** OAuth/OIDC\ **Created:** [October 20, 2017, 8:02pm UTC](https://devforum.okta.com/t/password-reset-angular-password-flow/620 "2017-10-20T20:02:26Z")\ **Posts on this page:** 9\ **Page:** 1
**Author:** ![jakehockey10](https://sea1.discourse-cdn.com/oktadev/user_avatar/devforum.okta.com/jakehockey10/32/122_2.png) [@jakehockey10](https://devforum.okta.com/u/jakehockey10)\ **Post date:** [October 20, 2017, 8:02pm UTC](https://devforum.okta.com/t/password-reset-angular-password-flow/620/1 "2017-10-20T20:02:26Z")
Hi @mraible ! Thanks again for the tutorials you’ve been putting online for Angular/Okta!ble I was wondering if you could point me in the right direction: I followed one of your tutorials to set up password flow for logging into okta in my Angular app. I’d like to allow my end-users to reset their password. What are my options? As I see it now, I could redirect them to Okta and let them do it there (is this possible? What’s the URL?), I could change my application to use the sign-in widget (which would be like starting all over with authentication, but maybe that’s not a bad thing if I get more functionality and less code I have to write), or there is a way I can do it with the authentication API. All of these alternatives have got me confused and I was wondering if I could reach out to you for some advice on this. Thanks! ---
**Author:** ![mraible](https://sea1.discourse-cdn.com/oktadev/user_avatar/devforum.okta.com/mraible/32/37_2.png) [@mraible](https://devforum.okta.com/u/mraible)\ **Post date:** [October 20, 2017, 9:07pm UTC](https://devforum.okta.com/t/password-reset-angular-password-flow/620/2 "2017-10-20T21:07:00Z")
What are you using for your backend? If you’re using Java, you could use Spring Security to the redirect to Okta for your and the login form allows password reset. [This tutorial](https://developer.okta.com/blog/2017/03/21/spring-boot-oauth) shows you how. You could also do this with [angular-oauth2-oidc](https://github.com/manfredsteyer/angular-oauth2-oidc). It’ll handle the redirect for you. Using the Sign-In Widget is an option too. ---
**Author:** ![jakehockey10](https://sea1.discourse-cdn.com/oktadev/user_avatar/devforum.okta.com/jakehockey10/32/122_2.png) [@jakehockey10](https://devforum.okta.com/u/jakehockey10)\ **Post date:** [October 23, 2017, 10:45pm UTC](https://devforum.okta.com/t/password-reset-angular-password-flow/620/3 "2017-10-23T22:45:06Z")
@mraible I just figured it out. I ended up sending a post request the the reset password endpoint in the okta Authentication API. This automically sends an email to the email address included in the params of the POST request. Thank you for your response! ---
**Author:** ![jakehockey10](https://sea1.discourse-cdn.com/oktadev/user_avatar/devforum.okta.com/jakehockey10/32/122_2.png) [@jakehockey10](https://devforum.okta.com/u/jakehockey10)\ **Post date:** [October 23, 2017, 10:46pm UTC](https://devforum.okta.com/t/password-reset-angular-password-flow/620/4 "2017-10-23T22:46:59Z")
I have a web api ([asp.net](http://asp.net) core 2.0) backend. I’m acquiring an id\_token from angular-oauth2-oidc on the client side. Then I’m using the id\_token to authenticate with my web api and get protected resources as well as okta profile information. Thanks for your promptness ---
**Author:** ![mraible](https://sea1.discourse-cdn.com/oktadev/user_avatar/devforum.okta.com/mraible/32/37_2.png) [@mraible](https://devforum.okta.com/u/mraible)\ **Post date:** [October 24, 2017, 12:07am UTC](https://devforum.okta.com/t/password-reset-angular-password-flow/620/5 "2017-10-24T00:07:34Z")
I’m glad to hear you got it figured out! Just FYI… you should be sending an access token to your API rather than the ID token. ---
**Author:** ![jakehockey10](https://sea1.discourse-cdn.com/oktadev/user_avatar/devforum.okta.com/jakehockey10/32/122_2.png) [@jakehockey10](https://devforum.okta.com/u/jakehockey10)\ **Post date:** [October 24, 2017, 12:34am UTC](https://devforum.okta.com/t/password-reset-angular-password-flow/620/6 "2017-10-24T00:34:23Z")
I was originally doing that, but the access token wasn’t providing sufficient information to do authorization based on groups in okta, and I read in the documentation that if you use just the id token, you can use it like the access token. Is there another reason you think I should be using the access token? ---
**Author:** ![tom](https://sea1.discourse-cdn.com/oktadev/user_avatar/devforum.okta.com/tom/32/24_2.png) [@tom](https://devforum.okta.com/u/tom)\ **Post date:** [October 24, 2017, 3:12pm UTC](https://devforum.okta.com/t/password-reset-angular-password-flow/620/7 "2017-10-24T15:12:58Z")
`id_token` is all about providing identity to the client that requested it `access_token` is all about authorization for a resource server These might seem like little nuances, but the id\_token that you are generating is meant for your angular client. There are a lot of libraries out there that will do audience and issue checking that will not work correctly if you pass an id\_token to your resource server. Now, that being said, you can get group information in the access token so your resource server can make the correct decisions. All you need to do is configure your authorization server to include groups in the access token 🙂 ![group_claims](https://global.discourse-cdn.com/oktadev/original/1X/9554f89bc05c355fc748d6d3adb8cc0dba30bf08.png) ---
**Author:** ![jakehockey10](https://sea1.discourse-cdn.com/oktadev/user_avatar/devforum.okta.com/jakehockey10/32/122_2.png) [@jakehockey10](https://devforum.okta.com/u/jakehockey10)\ **Post date:** [October 24, 2017, 3:42pm UTC](https://devforum.okta.com/t/password-reset-angular-password-flow/620/8 "2017-10-24T15:42:45Z")
I know for a fact that I’m confused, so let me know if this is outright wrong. But what I was doing before in the Angular client was asking for both the id\_token and the access\_token and using the access\_token for authorization and id\_token for authentication. The problem I was having was that I needed to send both for certain endpoint in my API and I wasn’t sure how to do that. But if the response type is just id\_token, the groups I need to use for authorization are included. As far as I could tell, the only way to do what I needed with sufficient information to do so was to either find a way to send the id\_token and access\_token at the same time to my web API, or I needed to have all the information I needed for both authentication and group-based authorization to be included into one token. This is the case when I make the response type id\_token according to this section of the docs: [https://developer.okta.com/standards/OIDC/index#claims](https://developer.okta.com/standards/OIDC/index#claims) ---
**Author:** ![andrea](https://sea1.discourse-cdn.com/oktadev/user_avatar/devforum.okta.com/andrea/32/2172_2.png) [@andrea](https://devforum.okta.com/u/andrea)\ **Post date:** [January 12, 2024, 7:51pm UTC](https://devforum.okta.com/t/password-reset-angular-password-flow/620/9 "2024-01-12T19:51:30Z")