Set a new password using a reset token

POST

/v1/auth/password-reset/confirm

curl --request POST \
  --url http://localhost:8080/v1/auth/password-reset/confirm \
  --header 'Content-Type: application/json' \
  --data '{ "token": "example", "password": "example" }'

• Local development

Consumes a single-use reset token and updates the user’s password. The token is invalidated on use; reuse or expired tokens return 422.

Request Body^required

Media typeapplication/json

object

token

required

string

password

required

string

>= 12 characters

Example ^generated

{
  "token": "example",
  "password": "example"
}

Responses

200

Password updated. Every session the user had is signed out.

Media typeapplication/json

object

message

required

string

Example

{
  "message": "password updated — sign in with your new password"
}

422

Token invalid/expired or password does not meet policy

Media typeapplication/json

object

error

object

type

One of invalid_request_error, authentication_error, rate_limit_error or api_error. Every error the API answers has this shape, including an unknown path (404, code route_not_found) and a method the path does not take (405, code method_not_allowed, with an Allow header). The few exceptions are listed in docs/api-surface.md.

string

code

string

message

string

request_id

string

param

The request field the error is about. Sent only when the error names one. A request body may hold only the fields its operation lists, spelled and cased as listed: any other field, or one the server sets (such as id), is refused with 422 and param naming it. An operation with no request body lists no fields: send no body, {} or null. The Stripe and Postmark webhooks and the LiteLLM callback take their sender’s body as it comes.

string

Example

{
  "error": {
    "type": "invalid_request_error"
  }
}