---
title: "Reset Password"
method: POST
path: "/api/auth/password/reset"
tags: ["auth"]
---

# Reset Password

`POST /api/auth/password/reset`

## Request

- Base URL: `https://api.advisorppc.com` (the document declares no server; this is the origin it was published from)
- URL: `https://api.advisorppc.com/api/auth/password/reset`
- Auth: none declared

Set a new password from an emailed reset token.

The caller is NOT signed in as a side effect: whoever holds the link proved
control of the mailbox, not of a browser session, and minting a session here
would hand one to anyone who could read the email in transit. The frontend
sends them to the sign-in form with the new password instead.

## Request body

- PasswordResetIn
  - `token` string, required
  - `password` string, required

## Response `200`

Successful Response

- PasswordResetOut
  - `reset` boolean

## Other responses

- `400`: The reset link is invalid, expired or already used.
- `422`: Validation Error
- `429`: Too many reset attempts from this client.

---

[API](https://skmtc.dev/advisorppc/apis/advisorppc-api.md) · [All operations](https://skmtc.dev/advisorppc/apis/advisorppc-api/llms.txt) · [OpenAPI document](https://skmtc.dev/advisorppc/apis/advisorppc-api/revisions/3441bd729e0c?raw)