Hi @jeremybong, thank you for adding more context.
I did some digging, and the problem seems to be that the api.redirect.sendUserTo() method is not meant for this use case, and it’s what causes the infinite loop.
I couldn’t find a feature specifically designed for your use case, but there are a couple of things I think you could try:
-
Forcing a user to authenticate, as described by my colleague Rueben in this community topic.
-
Use the Resource Owner Password Grant flow to verify the current password as described in this Knowledge Article for a similar topic, verifying the current password before changing to a new password.
I hope this helps you!
Kind regards,
Teodor.