How to Implement User Profiles
In this document, you’ll learn how to implement user profile management features using the admin APIs.
Overview
The user’s admin APIs allow you to retrieve and perform admin functionalities on users.
Scenario
You want to add or use the following admin functionalities:
- User authentication, meaning user log in and log out.
- Manage profile, including retrieving profile details and updating profile.
- Reset password
Prerequisites
It is assumed that you already have a Medusa backend installed and set up. If not, you can follow the quickstart guide to get started.
JS Client
This guide includes code snippets to send requests to your Medusa backend using Medusa’s JS Client, JavaScript’s Fetch API, or cURL.
If you follow the JS Client code blocks, it’s assumed you already have Medusa’s JS Client installed and have created an instance of the client.
Medusa React
This guide also includes code snippets to send requests to your Medusa backend using Medusa React, among other methods.
If you follow the Medusa React code blocks, it's assumed you already have Medusa React installed and have used MedusaProvider higher in your component tree.
Authenticated Admin User
Aside from the User Login and Reset Password steps, other API Routes require you to be an authenticated admin user.
You can learn more about authenticating as an admin user in the API reference.
User Authentication
User Login
You can log in a user by sending a request to the User Login API Route:
This API Route requires the following request body parameters:
email
: a string indicating the user’s email.password
: a string indicating the user’s password.
The request returns the logged-in user as an object.
User Logout
You can log out a user by sending a request to the User Logout API Route:
The API Route doesn't require any path or query parameters.
The request doesn't return any data. The response code will be 200
for successful log out.
Retrieve User Profile Details
You can retrieve the current user’s details for their profile by sending a request to the Get Current User API Route:
This API Route doesn't require any parameters.
The request returns the current user as an object.
Update User’s Profile Details
You can update a user’s details in their profile by sending a request to the Update User API Route:
import {
useAdminUpdateUser,
} from "medusa-react"
type Props = {
userId: string
}
const Profile = ({ userId }: Props) => {
const updateUser = useAdminUpdateUser(userId)
// ...
const handleUpdate = (firstName: string) => {
updateUser.mutate({
first_name: firstName,
}, {
onSuccess: ({ user }) => {
console.log(user.first_name)
}
})
}
// ...
}
export default Profile
This API Route requires the ID of the user as a path parameter.
In the request body, you can pass any of the user’s fields that you want to update as a parameter. In the example above, you pass the first_name
parameter to update the user’s first name. You can refer to the API reference to learn about other available parameters.
The request returns the updated user as an object.
Reset Password
This section explains how you can reset the password of a user if they forgot their password.
Step 1: Request Password Reset
The first step is to request a password reset. This would create in the Medusa backend a reset password token, which you typically would use in an email sent to the user. The email would include a link that allows the user to enter a new password, and the link would accept a token query parameter to be used in step 2.
Sending the password reset email is not handled by default in the Medusa backend. You can either use the SendGrid plugin which handles it, or manually subscribe to the user.password_reset
event and send the email.
You can request a password reset by sending a request to the Request Password Reset API Route:
import { useAdminSendResetPasswordToken } from "medusa-react"
const Login = () => {
const requestPasswordReset = useAdminSendResetPasswordToken()
// ...
const handleResetPassword = (
email: string
) => {
requestPasswordReset.mutate({
email
}, {
onSuccess: () => {
// successful
}
})
}
// ...
}
export default Login
This API Route requires the email
parameter in the request body, which is the email of the user requesting to reset their password.
The request does not return any data. The response code will be 204
if the request was processed successfully.
Step 2: Reset Password
After the user resets their password and, typically, receives an email with a link to reset their password, they should enter their new password. The new password, along with the token passed to this page are used to reset the password on the Medusa backend.
You can reset the password by sending a request to the Reset Password API Route:
import { useAdminResetPassword } from "medusa-react"
const ResetPassword = () => {
const resetPassword = useAdminResetPassword()
// ...
const handleResetPassword = (
token: string,
password: string
) => {
resetPassword.mutate({
token,
password,
}, {
onSuccess: ({ user }) => {
console.log(user.id)
}
})
}
// ...
}
export default ResetPassword
fetch(`<BACKEND_URL>/admin/users/reset-password`, {
credentials: "include",
method: "POST",
headers: {
"Content-Type": "application/json",
},
body: JSON.stringify({
token: "supersecrettoken",
password: "supersecret",
}),
})
.then((response) => response.json())
.then(({ user }) => {
console.log(user.id)
})
This API Route requires the following request body parameters:
token
: a string indicating the password reset token.password
: a string indicating the new password for the user.
You can also optionally pass the email
parameter in the request body.
The request returns the user as an object, and the user is automatically logged in.