title: .Net Core Reset Password Token and Identityserver 4 token invalid
body: <p>My applications and APIs are protected using IdentityServer 4.</p>
  
  <p>I have a centralized API for user management (registering new users, updating, deleting and resetting passwords). The token generated by this api will be used by identityserver to reset the user's password.</p>
  
  <p><em>Problem is I always get invalid token error.</em> I know this has nothing to do with url encoding because forgotten password is handled by identity server and the token generated by identity server works fine. The problem is when a token is generated by different api (even on a single machine).</p>
  
  <p>I looked into creating a common data protection provider but I'm unclear how this is done. <strong>Basically, how can I have reset password token created by one api accepted by another?</strong></p>
  
  <p>I'm using Asp Identity's usermanager to generate the reset password token:</p>
  
  <pre><code>var token = await _userManager.GeneratePasswordResetTokenAsync(appUser);
  </code></pre>
  
  <p>This is how my IdentityServer is setup to use Asp Identity:</p>
  
  <pre><code>services
      .AddIdentity&lt;ApplicationUser, IdentityRole&gt;(options =&gt;
          {
              options.Lockout.AllowedForNewUsers = true;
              options.Lockout.DefaultLockoutTimeSpan = new System.TimeSpan(12, 0, 0);
              options.Lockout.MaxFailedAccessAttempts = int.Parse(Configuration["MaxFailedAttempts"]);
          })
      .AddEntityFrameworkStores&lt;ApplicationDbContext&gt;()
      .AddDefaultTokenProviders();
  
  ...
  
  var builder = services.AddIdentityServer(options =&gt;
              {
                  options.Events.RaiseErrorEvents = true;
                  options.Events.RaiseInformationEvents = true;
                  options.Events.RaiseFailureEvents = true;
                  options.Events.RaiseSuccessEvents = true;
                  options.Authentication.CookieSlidingExpiration = true;
              })
              .AddAspNetIdentity&lt;ApplicationUser&gt;()
              .AddConfigurationStore(options =&gt;
                  {
                      options.ConfigureDbContext = b =&gt;
                      b.UseSqlServer(connectionString,
                      sql =&gt; sql.MigrationsAssembly(migrationsAssembly));
  
                      options.DefaultSchema = Globals.SCHEMA_IDS;
                  })
              // this adds the operational data from DB (codes, tokens, consents)
              .AddOperationalStore(options =&gt;
                  {
                      options.ConfigureDbContext = b =&gt;
                      b.UseSqlServer(connectionString,
                      sql =&gt; sql.MigrationsAssembly(migrationsAssembly));
  
                      options.DefaultSchema = Globals.SCHEMA_IDS;
                      // this enables automatic token cleanup. this is optional.
                      options.EnableTokenCleanup = true;
                      options.TokenCleanupInterval = 30;
                  })
              .AddProfileService&lt;CustomProfileService&gt;()
              .AddSigninCredentialFromConfig(Configuration.GetSection("SigninKeyCredentials"), Logger);
  </code></pre>
  
  <p>and this is how my UserManagement Api is setup to use Asp Identity:</p>
  
  <pre><code>services.AddTransient&lt;IUserStore&lt;ApplicationUser&gt;, UserStore&lt;ApplicationUser, IdentityRole, ApplicationDbContext&gt;&gt;();
  services.AddTransient&lt;IRoleStore&lt;IdentityRole&gt;, RoleStore&lt;IdentityRole, ApplicationDbContext&gt;&gt;();
  services.AddTransient&lt;IPasswordHasher&lt;ApplicationUser&gt;, PasswordHasher&lt;ApplicationUser&gt;&gt;();
  services.AddTransient&lt;ILookupNormalizer, UpperInvariantLookupNormalizer&gt;();
  services.AddTransient&lt;IdentityErrorDescriber&gt;();
  
  var identityBuilder = new IdentityBuilder(typeof(ApplicationUser), typeof(IdentityRole), services);
  identityBuilder.AddTokenProvider("Default", typeof(DataProtectorTokenProvider&lt;ApplicationUser&gt;));
  services.AddTransient&lt;UserManager&lt;ApplicationUser&gt;&gt;();
  </code></pre>