Skip to content
LogoLogo

Change the current user's password

Change the current user's password

POST/api/v1/auth/password/change

Replaces the password for the authenticated user. The current password is required: an unattended browser must not be enough to lock the owner out.

Unlike a reset, a change keeps the session that performed it and revokes every other session, so the user is not signed out of the browser they are using.

An account that signs in only through an identity provider has no password to change and receives 409.

Header Parameters

X-CSRF-TokenRequired
string·min 43·max 43

Session-bound CSRF token. It must exactly match the __Host-assign_csrf cookie sent with the request.

Request Body

application/json
current_passwordRequired
string <password>·min 1·max 128
new_passwordRequired
string <password>·min 12·max 128

Between 12 and 128 characters. There are deliberately no composition rules: length and non-reuse resist guessing, while character-class rules mostly produce predictable substitutions. Passwords appearing in a known breach corpus are refused.

Responses