New password provided workflow

Trigger: user:new_password_provided

This trigger fires after a new password is entered in either the sign-up flow or the reset password flow.

Security considerations

Link to this section

Security is at the heart of our technical decisions at Kinde, and keeping user passwords safe is a huge part of this. Therefore:

• Any attempt to log the password out to the console in this workflow will be redacted
• API calls can only be made from these workflows using the Kinde provided secureFetch method which secures the payload with an encryption key

Example use cases

Link to this section

Custom password strength policy

Link to this section

As a baseline, Kinde runs the following password checks:

• A password is supplied
• The password is at least 8 characters long
• The password does not exist in the 1,000,000 most common passwords

With this workflow you can add your own custom code to run additional checks, for example if your business requires a specific mix of upper / lower case characters, or inclusion of special characters.

Sync password with an external system

Link to this section

For gradual migrations to Kinde where several apps are in play (e.g. a mobile application and a web application), you might want to migrate web users first and mobile app users later. If users have access to both applications, then password resets on the web application would not be persisted to the legacy mobile app password store.

With this workflow you can securely send the password to your mobile app system in order to keep them in sync.

Workflow code

Link to this section

The event object

Link to this section

The main argument provided to your code is the Kinde workflow event object which has two keys request and context. This gives you access to the reason the workflow was triggered. Here’s an example:

{
  "request": {},
  "context": {
    "domains": {
      "kindeDomain": "https://example.kinde.com" // Your Kinde domain
    },
    "auth": {
      "firstPassword": "someSecurePassword", // the first password entered
      "secondPassword": "someSecurePassword", // password match field
      "newPasswordReason": "reset" | "initial" // whether it is registration or reset
    }
    "user": {
        "id": "kp_1234566" // only provided in password reset flows as otherwise new user
        "email": "hello@example.com" // the email provided
    }
}

Workflow settings

Link to this section

export const workflowSettings = {
  id: "passwordReset",
  name: "Reset password",
  failurePolicy: {
    action: "stop",
  },
  trigger: "user:new_password_provided",
  bindings: {
    "kinde.secureFetch": {}, // Required for external API calls
    "kinde.widget": {}, // Required to invalidate the form
  },
};

Secure fetch binding

Link to this section

When an API call is made using kinde.secureFetch() the body is automatically encrypted with the active encryption key for the workflow. This can be generated under Workflow > Encryption keys.

You will need to use the same encryption key in your own code to decrypt the payload on arrival. This ensures secure transfer of the password.

We handle the encryption for you so your code might look like:

Widget binding

Link to this section

The kinde.widget binding gives you access to the Kinde widget which is the central form on the page. In this case the form with the two password fields.

It exposes a method for invalidating a form field invalidateFormField.

kinde.widget.invalidateFormField(fieldName, message);

Example

const isMinCharacters = context.auth.firstPassword.length >= 50;

kinde.widget.invalidateFormField("p_password_1", "Provide a password at least 50 characters long");

The field names for this workflow are

Field name	Description
p_password_1	The first password field
p_password_2	The second password field, typically to check it matches the first to help prevent typos