> For the complete documentation index, see [llms.txt](https://tech.x2bee.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://tech.x2bee.com/api-guide/api-guides-en/store-front/member/find-id-password.md).

# Find ID/Password

Provides a feature for general members enrolled in the shopping mall to recover a lost ID or password. This service verifies identity through mobile phone identity verification, then retrieves and modifies data from either the separate storage DB or the general DB depending on dormant member status. When a password recovery request is made, a JWT-based token valid for 5 minutes is generated and used to proceed with the password change.

***

## Key Features

* **Find ID and Password**
  * Members can find their ID by completing mobile phone identity verification and confirming their registered mobile phone number.
  * Members can find their password by completing mobile phone identity verification and confirming their registered mobile phone number and ID.
* **Mobile Phone Identity Verification**
  * Members verify their identity through mobile phone identity verification, confirming whether it matches the mobile phone number of the account they are trying to find.
* **Dormant Member Lookup and Modification**
  * For dormant members, data is retrieved and modified from the separate storage DB.
* **Token Generation**
  * When a password recovery request is made, a JWT-based token valid for 5 minutes is generated.
* **Token Authentication and Authorization**
  * Authentication and authorization are performed by comparing the validity period of the received token with the token stored on the server side.
* **Password Change**
  * Once token authentication is complete, the password is changed to the new password requested by the user.

## Process Definition

<figure><img src="https://2999922013-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FXTxKSWMmuxEkop1pvuwe%2Fuploads%2FB4WJYOK4A7D9DBtHhlvM%2F%E1%84%8B%E1%85%A1%E1%84%8B%E1%85%B5%E1%84%83%E1%85%B5%E1%84%87%E1%85%B5%E1%84%86%E1%85%B5%E1%86%AF%E1%84%87%E1%85%A5%E1%86%AB%E1%84%92%E1%85%A9%20%E1%84%8E%E1%85%A1%E1%86%BD%E1%84%80%E1%85%B5.png?alt=media&#x26;token=84fd5f45-5752-4767-889a-e3b0cf012aba" alt=""><figcaption></figcaption></figure>

{% stepper %}
{% step %}

### Find ID

The user finds the ID of their lost account.

**1-1. Verify Member Information**

Member information is verified using the identity verification information.

**1-2. Look Up ID**

Once membership is confirmed in \[Verify Member Information], the member's account ID is retrieved.
{% endstep %}

{% step %}

### Find Password

The user finds the password of their lost account.

**2-1. Token Issuance**

After verifying member information using the identity verification information and the provided member ID, a password recovery token valid for 5 minutes is generated and saved on the server side.

**2-2. Token Verification**

Before proceeding with the password change, the system checks whether the password recovery token generated in the previous step is valid.
{% endstep %}

{% step %}

### Password Change Request

The user requests to change to a new password. There are three password change processes: verified change of the existing password, immediate password change, and change after 90 days; each process branches based on a classification type code. In the password recovery flow, the immediate password change process is used.

**3-1. Immediate Password Change**

For a token that has been authenticated and authorized in \[Token Verification], the password is changed to the new one without requiring the account's existing password.

**3-2. Password Change Processing**

The password change processing applies the password creation rules, modifies the password, and updates the password change date.
{% endstep %}
{% endstepper %}

## API Function List

<table><thead><tr><th width="127.888916015625">API</th><th width="252.77783203125">Description</th><th width="93.5555419921875">Server</th><th width="88.22216796875">Method</th><th>Remarks</th></tr></thead><tbody><tr><td>Find Password (Generate Token)</td><td>Finds the password of a member who has lost their account password. When finding a password, identity verification is followed by generation of a token for the password change.</td><td>Member</td><td>POST</td><td><a href="http://api.x2bee.com/content?msa=member&#x26;depth=%EC%95%84%EC%9D%B4%EB%94%94%20%EB%B9%84%EB%B0%80%EB%B2%88%ED%98%B8%EC%B0%BE%EA%B8%B0&#x26;path=insertFindPwdToken">🔗View API></a></td></tr><tr><td>Find Password (Change Directly)</td><td>Finds the password of a member who has lost their account password. Proceeds after the Find Password (Generate Token) step, using the generated token to request the password change.</td><td>Member</td><td>PUT</td><td><p>Used in V1.03 source</p><p><a href="https://api.x2bee.com/content?msa=member&#x26;depth=%EC%95%84%EC%9D%B4%EB%94%94%20%EB%B9%84%EB%B0%80%EB%B2%88%ED%98%B8%EC%B0%BE%EA%B8%B0&#x26;path=modifyFindPassword">🔗View API></a></p></td></tr><tr><td>Find Password</td><td>Finds the password of a member who has lost their account password. Proceeds after the Find Password (Generate Token) step, using the generated token to request the password change.</td><td>Member</td><td>PUT</td><td><p>Used in V1.0 source</p><p><a href="https://api.x2bee.com/content?msa=member&#x26;depth=%EC%95%84%EC%9D%B4%EB%94%94%20%EB%B9%84%EB%B0%80%EB%B2%88%ED%98%B8%EC%B0%BE%EA%B8%B0&#x26;path=modifyMemberFindPw">🔗View API></a></p></td></tr><tr><td>Change Password</td><td>Changes the member's account password. Changes the password to the new one requested by the member.</td><td>Member</td><td>PUT</td><td><a href="https://api.x2bee.com/content?msa=member&#x26;depth=%EC%95%84%EC%9D%B4%EB%94%94%20%EB%B9%84%EB%B0%80%EB%B2%88%ED%98%B8%EC%B0%BE%EA%B8%B0&#x26;path=modifyPassword">🔗View API></a></td></tr><tr><td>Find ID</td><td>Finds the account ID of a member who has lost their ID. After identity verification, looks up the ID of the account registered with that information.</td><td>Member</td><td>POST</td><td><a href="https://api.x2bee.com/content?msa=member&#x26;depth=%EC%95%84%EC%9D%B4%EB%94%94%20%EB%B9%84%EB%B0%80%EB%B2%88%ED%98%B8%EC%B0%BE%EA%B8%B0&#x26;path=getMemberFindId">🔗View API></a></td></tr></tbody></table>

## Definition of Terms

<table><thead><tr><th width="164">Term</th><th>Description</th><th data-hidden></th></tr></thead><tbody><tr><td>Password Recovery Token</td><td>A token generated via JWT authentication, valid for 5 minutes. If the password is not changed within 5 minutes, the identity verification process must be repeated to generate a new token.</td><td></td></tr><tr><td>Verified Password Change</td><td>To change the password, the user enters the previous password and the new password. The change proceeds to the new password only if the previous password matches.</td><td></td></tr><tr><td>Immediate Password Change</td><td>To change the password, the user enters only the new password. This process is used when the account password has already been verified in a prior step; the password can be changed after that prior process (password verification) is complete.</td><td></td></tr><tr><td>Change After 90 Days</td><td>A service that defers the password change for 90 days by updating the member's password change date to the current date while keeping the current password.</td><td></td></tr></tbody></table>

## Other Notes

* **Find Password (Generate Token)**
  * Finds the password for members who signed up as general members and have lost their password. For social members, since the password for each social channel is managed separately, password recovery must be done through the respective social channel.
  * If the account owner is confirmed to match through identity verification, a password recovery token is generated for changing the account password. This token is generated using JWT authentication and is valid for 5 minutes. The generated token information is stored in the server's ET\_MBR\_CERTI\_TKN\_ISSU\_INFO table.
* **Find Password (Change Directly)**
  * When a request comes in with the token generated in Find Password (Generate Token), the system checks whether the token is within its validity period and was properly generated by the server. If the request is made with a valid token, the password is changed to the new one entered by the user, and the token is discarded and can no longer be reused.
  * The Find Password (Change Directly) process uses the 'Immediate Password Change' service among the password change processes.
* **Change Password**
  * Changes the member's password. Password changes only apply to general members whose passwords are directly managed by the X2BEE shopping mall.
  * When changing the password, the process branches into three services depending on the classification value: 'Verified Password Change', 'Immediate Password Change', and 'Change After 90 Days'.
  * Verified Password Change takes both the existing password and the new password and processes the change only if the existing password matches.
  * Immediate Password Change is used after the existing password has already been verified before accessing the password change page. Only the new password is entered before proceeding with the change.
  * Change After 90 Days updates the password change date to the current time while keeping the current password.
* **Identity Verification**
  * To use the Find ID or Find Password service, the user must go through the mobile phone identity verification process to confirm both membership in the X2BEE shopping mall and account ownership.