API User Create - Force Password Change

AgapeList

I've successfully managed to implement a Make.com integration to create new users in my flarum database takes bow yes very impressed with myself.

My intention is to create a forum user in another app, enter a password and get them registered. Is there a way to set the force password change flag though? The data I receive back as a response doesn't appear to include it, so I have no idea what the flag is called if available.

Thanks

GreXXL

AgapeList there is an extension for resetting all forum passwords which you can take as an inspiration: https://flarum.org/extension/sycho/flarum-force-password-reset

AgapeList

Thanks for that, it's just the new user that I create via the /api/users endpoint.

When you create a user via the front end you can set a flag to force a password change, I'd like to do it that way.

huseyinfiliz

AgapeList Congratulations on getting the Make.com integration working! That's definitely something to take a bow for.

To answer your question: I took a look at the core files (specifically RegisterUserHandler.php), and unfortunately, there is no native flag like forcePasswordChange built into the Flarum API when creating a new user.
flarum/frameworkblob/main/framework/core/src/User/Command/RegisterUserHandler.php

However, there is a very practical workaround you can do entirely within Make.com by adding just one more step to your scenario:

Trigger the Forgot Password Flow:

Continue creating the user in your first Make.com module, but generate a very strong, random password for them.
Immediately after that module, add another HTTP request module in Make.com that sends a POST request to Flarum's /api/forgot endpoint, passing the email address of the user you just created.

This will automatically trigger a password reset email. That way, the user's very first step to access the forum will be clicking that link and setting a password of their own choosing.

Hope this helps!

AgapeList

huseyinfiliz

Thanks! I'll give that a try. Is there a way to suppress the first register email, otherwise there potential for confusion.

huseyinfiliz

AgapeList try this: "isEmailConfirmed": true

{
  "data": {
    "type": "users",
    "attributes": {
      "username": "NewUser",
      "email": "user@example.com",
      "password": "SuperSecretRandomPassword123!",
      "isEmailConfirmed": true
    }
  }
}

AgapeList

huseyinfiliz

Awesome! Thanks!

KBExit

Great job! I've accomplished something similar with N8N in the past and just triggered an email to be sent telling them the instructions on password reset and a welcome message all in one 🙂
This flow should also work too!

I've since adopted the magic link method of authentication where the user tried to login and they get an email to verify their session without the need of a password. This made sense since I got N8N to talk to Ghost which uses the same method.