WordPress OTP Password Reset API

A custom WordPress REST API for handling secure password resets via OTP (One-Time Password). This system provides endpoints to request an OTP, verify it, and reset the password.

Endpoints

🔹 Request OTP

URL:
POST http://localhost/wp-lms/wp-json/otp/v1/request

Request Body:

{
  "email": "email@example.com"
}

Success Response:

{
  "email": "ziadmohamedelganzory@gmail.com"
}

🔹 Verify OTP

URL:
POST http://localhost/wp-lms/wp-json/otp/v1/verify

Request Body:

{
  "user_id": 1,
  "otp": 123456
}

Success Response:

{
  "message": "OTP valid",
  "password_key": "Hashed Password Reset Key Stored in user_activation_key table"
}

🔹 Reset Password

URL:
POST http://localhost/wp-lms/wp-json/otp/v1/reset

Request Body:

{
  "email": "email@example.com",
  "reset_key": "Hashed Password Reset Key Stored in user_activation_key table",
  "new_password": "New Password"
}

Success Response:

{
  "message": "Password reset successfully"
}

Flow Overview

1. Request OTP:
   User sends their email to request an OTP.

2. Receive OTP & User ID:
   User receives an email with their OTP and user ID.

3. Verify OTP:
   User submits their user ID and OTP to get a password reset key.

4. Reset Password:
   User provides email, reset key, and a new password to reset the account password.

5. Password Reset Complete

Security Notes

• It is recommended to securely store user_id and password_key (e.g., in cookies or local storage) on the frontend.

Future Enhancements

• Implement secure frontend handling of user_id and password_key.
• Possible backend modifications to support more secure workflows.