Reset a password with a token
Reset a password with a token
/api/v1/auth/password/resetRedeems a single-use reset token and replaces the password.
A reset revokes every session for the account, including the one making the request: a reset is what an account-takeover victim performs, so the attacker's session must not survive it, and the holder of a mailed token has not otherwise authenticated. Both browser-session cookies are expired in the response.
Request Body
application/jsonstring·min 1·max 512A single-use, expiring bearer secret delivered by email. Only its hash is stored, so it cannot be recovered from a database disclosure. Treat it as a credential: never log it or place it in a URL you retain.
Responses
string·const no-storePrevents storage of error responses by clients and intermediaries.
string·const no-storePrevents storage of error responses by clients and intermediaries.
string·min 1·max 200Correlation identifier for the request.
string·const nosniffPrevents user agents from MIME-sniffing the response.
integer·min 1Seconds until the client may retry.
integer·min 0Delay in seconds before retrying, when an expected maintenance end is known.
string·const no-storePrevents storage of error responses by clients and intermediaries.
string·min 1·max 200Correlation identifier for the request.
string·const nosniffPrevents user agents from MIME-sniffing the response.