Unable to validate recovery token

[en9662]

Hi All,

I’m trying to validate recovery token through /api/v1/authn/recovery/token. However, request keeps getting rejected and returns this response:

{
“errorCode”: “E0000079”,
“errorSummary”: “This operation is not allowed in the current authentication state.”,
“errorLink”: “E0000079”,
“errorId”: “oaefY5RhfksfaO81wUS43A”,
“errorCauses”: [
{
“errorSummary”: “This operation is not allowed in the current authentication state.”
}
]
}

Note that I provide a valid recovery token that’s retrieved from forgot_password response: /api/v1/users/0xxxxxxxxxxxx7/credentials/forgot_password?sendEmail=false

Any thoughts on what’s causing recovery/token to fail?

[erik]

Hello,

Can you provide the Okta Request id for one of these failed attempts. It would be returned in the HTTP headers x-okta-request-id.

If not are you able to provide your Okta Org you are testing in?

Thank You,

[en9662]

I just figured that The /api/v1/authn/recovery/token API works in conjunction with the /api/v1/authn/recovery/password API. So, token will not be validated if it’s retrieved from forgot_password URL

[erik]

Outstanding,
using

/api/v1/users/<id>/credentials/forgot_password?sendEmail=false

with

/api/v1/authn/recovery/token

does work in my Org, but if you have a working solution that is great.