{"record":{"id":"ca97ee7625f34aee","repo":"payloadcms/payload","slug":"error-notallowedtoperformaction-ca97ee","errorCode":null,"errorMessage":"error:notAllowedToPerformAction","messagePattern":"error:notAllowedToPerformAction","errorType":"exception","errorClass":"Forbidden","httpStatus":403,"severity":"error","filePath":"packages/payload/src/auth/operations/resetPassword.ts","lineNumber":59,"sourceCode":"    data,\n    depth,\n    overrideAccess,\n    req: {\n      payload: { secret },\n      payload,\n    },\n    req,\n  } = args\n\n  if (\n    !Object.prototype.hasOwnProperty.call(data, 'token') ||\n    !Object.prototype.hasOwnProperty.call(data, 'password')\n  ) {\n    throw new APIError('Missing required data.', httpStatus.BAD_REQUEST)\n  }\n\n  if (collectionConfig.auth.disableLocalStrategy) {\n    throw new Forbidden(req.t)\n  }\n\n  let sid: string | undefined\n  let user: null | User = null\n\n  try {\n    const shouldCommit = await initTransaction(req)\n\n    args = await buildBeforeOperation({\n      args,\n      collection: args.collection.config,\n      operation: 'resetPassword',\n      overrideAccess,\n    })\n\n    // /////////////////////////////////////\n    // Reset Password\n    // /////////////////////////////////////","sourceCodeStart":41,"sourceCodeEnd":77,"githubUrl":"https://github.com/payloadcms/payload/blob/00c58b35c0ed348ddc22daabf467b139727214fd/packages/payload/src/auth/operations/resetPassword.ts#L41-L77","documentation":"Thrown in `resetPassword` when `collectionConfig.auth.disableLocalStrategy` is true. The collection does not store local credentials, so resetting a password locally is not applicable. `Forbidden` (HTTP 403).","triggerScenarios":"A collection configured with `auth: { disableLocalStrategy: true }` (external IdP / JWT strategy) receives a reset-password request. Payload bails before touching credentials.","commonSituations":"Pointing the reset-password flow at an SSO-only collection; a shared frontend that doesn't branch on `disableLocalStrategy`; misconfiguring a collection that should handle passwords locally.","solutions":["Route password resets only to collections with a local strategy (`disableLocalStrategy: false`).","For external-strategy collections, perform password reset through the IdP instead.","Branch client logic: skip the Payload reset call when `auth.disableLocalStrategy` is true."],"exampleFix":"// before\nawait payload.resetPassword({ collection: 'users', data, req })\n// after\nif (!collectionConfig.auth.disableLocalStrategy) {\n  await payload.resetPassword({ collection: 'users', data, req })\n}","handlingStrategy":"validation","validationCode":"// Only reset passwords for local-strategy collections\nif (collectionConfig.auth.disableLocalStrategy) {\n  throw new Error('Password reset is unavailable for this collection')\n}\nawait payload.resetPassword({ collection, data, req })","typeGuard":"function supportsLocalPassword(cfg: CollectionConfig): boolean {\n  return !cfg.auth?.disableLocalStrategy\n}","tryCatchPattern":"if (collectionConfig.auth.disableLocalStrategy) {\n  // route to the IdP's password-reset flow\n} else {\n  await payload.resetPassword({ collection, data, req })\n}","preventionTips":["Branch reset flows on `disableLocalStrategy`.","Keep SSO collection slugs out of password-reset UI.","Document which collections own their own credentials."],"tags":["auth","reset-password","sso","config"],"backgroundTag":null,"analyzedSha":"00c58b35c0ed348ddc22daabf467b139727214fd","analyzedAt":"2026-08-12T20:45:03.758Z","schemaVersion":2},"datasetVersion":"2026-08-12T23:17:12.415Z"}