Forgot Password

Overview

• Description: This process is based on existing underlying business logic (e.g., automatic phone prefix tolerance, mock SMS mode) and is separated into three independent stateless APIs.

1. POST - Send OTP

• URL: /client/member/forgot-password/send-otp
• Method: POST
• Content-Type: application/json or multipart/form-data
• Authentication: Base Token (A valid Authorization: Bearer <baseToken> must be passed in the Header)

Description: Verifies the phone number and sends a 6-digit OTP. If the SMS gateway is disabled in the backend, the OTP will be returned directly in the response data (mock mode).

Headers

Parameter	Required	Type	Description
Authorization	Yes	String	Base Token, obtained via the Basic Auth API

Request Parameters (Body)

Parameter	Type	Required	Description
country_code	String	Yes	Country code (currently only supports 60)
phone	String	Yes	Registered phone number

Response Example

{
  "code": 0,
  "msg": "OTP Sent",
  "data": {
    "frontend_sms_enabled": true,
    "otp": "" 
  }
}

2. POST - Verify OTP

• URL: /client/member/forgot-password/verify-otp
• Method: POST
• Content-Type: application/json or multipart/form-data
• Authentication: Base Token (A valid Authorization: Bearer <baseToken> must be passed in the Header)

Description: Submit the received OTP for verification. The OTP is valid for 3600 seconds (1 hour).

Headers

Parameter	Required	Type	Description
Authorization	Yes	String	Base Token, obtained via the Basic Auth API

Request Parameters (Body)

Parameter	Type	Required	Description
verify_code	String	Yes	Received 6-digit OTP

Response Example

{
  "code": 0,
  "msg": "OTP Verified",
  "data": {
    "reset_token": "xxxxxx" 
  }
}

3. POST - Reset Password

• URL: /client/member/forgot-password/reset-password
• Method: POST
• Content-Type: application/json or multipart/form-data
• Authentication: Base Token (A valid Authorization: Bearer <baseToken> must be passed in the Header)

Description: Use the token obtained in the previous step and the new password to reset. The underlying logic supports tolerant phone number matching (handling historical data prefixes like 600 vs 60).

Headers

Parameter	Required	Type	Description
Authorization	Yes	String	Base Token, obtained via the Basic Auth API

Request Parameters (Body)

Parameter	Type	Required	Description
reset_token	String	Yes	Token obtained after successful OTP verification
newpassword	String	Yes	New password, minimum 8 characters

Response Example

{
  "code": 0,
  "msg": "Password updated",
  "data": {}
}