Set temporary password

If you have set up password authentication for your users, you might want to set or update their password. Kinde lets you set a single-use, temporary password to enable authentication. There are a number of reasons why you might need to do this, for example:

• You don’t allow self-sign-up, so you provide sign in and password details to all new users
• You don’t have a valid email for the user
• The user cannot access their email or phone, to receive a reset password code

When you set a temporary password, you’ll need to communicate it to the user via your own method. Kinde cannot send a temporary password via email or SMS.

Security warning

Link to this section

Setting a temporary password is not a very secure way of helping a user sign in. The password might be overheard or intercepted after you send it, and it could be misused and make your systems vulnerable.

If you have an email for the user, we recommend triggering a password reset instead.

Signing in with a temporary password

Link to this section

To use a temporary password, the user signs in with their email, or other identity credential, and uses the temporary password. They will be immediately prompted to set a new password of their own creation. Once used, the temporary password becomes invalid.

Set a temporary password in Kinde

Link to this section

1. In Kinde, go to Users, then open the profile of the user.

2. Scroll to the bottom of the page to the Admin actions section.

3. In the Manage passwords area, select Set temporary password.

4. In the window that appears, enter a password.

   The password must be more than 8 characters, not common or guessable (e.g. not Password123). We recommend a mix of alphanumeric characters in upper and lowercase. Special characters are optional.

5. To view the password, select the ‘eye’ icon.

6. Select Set temporary password.

7. Communicate the password to the user.

Set or update a password via Kinde API

Link to this section

The Set user password API allows you to supply a hashed password for a user. If you pass the is_temporary_password: true to the API it will set a password as being single-use.

We only accept password hashes and will never allow plain text passwords

Include the following information for the password API:

• hashed_password — the user’s hashed password
• hashing_method — the algorithm used to hash the password. Supported values are bcrypt, crypt, md5, sha256, wordpress, pbkdf2, firebase-scrypt, and aspnet-identity-v2. The Set user password API reference is the source of truth for which parameters each method requires.

bcrypt $2b variant support

Kinde substitutes bcrypt $2b hashes with $2a. These are interchangeable unless the hashes were generated on OpenBSD.

ASP.NET Identity v2 support

For aspnet-identity-v2, send the PasswordHash value from the ASP.NET Identity AspNetUsers table as hashed_password. Do not send salt, salt_position, iterations, or variant because those parameters are embedded in the hash. See Migrate to Kinde from ASP.NET Identity.

sha256 support

Provide the hash in hex format. For salt_format, use hex for a hex-encoded string, such as 68656c6c6f for hello. By default, Kinde treats the salt as a plain string and treats escape sequences such as \n or \v as literal characters.

pbkdf2 support

Send the base64-encoded salt and a variant of salted-pbkdf2-hmac-sha256, salted-pbkdf2-hmac-sha256-512, or salted-pbkdf2-hmac-sha512-512. iterations is optional and defaults to 24000 when omitted.

firebase-scrypt support

Send the user’s base64-encoded salt plus your Firebase project’s signer_key, salt_separator, rounds, and mem_cost. See importing from Firebase for where to find these values.

• salt — extra characters added to passwords before hashing
• salt_position — position of the salt in the password string, either prefix or suffix

Hashing method	Salt	Salt position
md5	Optional	Required if salt included
bcrypt	—	—
crypt	Optional	—
wordpress	Optional	—
sha256	Optional	Required if salt included
pbkdf2	Required (base64)	—
firebase-scrypt	Required (base64, per user)	—
aspnet-identity-v2	Embedded in the hash	—

• is_temporary_password — indicates a single-use password. The user is prompted to set a new password after using it once.