---
title: "Set Password"
method: POST
path: "/api/v1/auth/set-password"
tags: ["Auth"]
---

# Set Password

`POST /api/v1/auth/set-password`

## Request

- Base URL: `https://api.africadb.com` (the document declares no server; this is the origin it was published from)
- URL: `https://api.africadb.com/api/v1/auth/set-password`
- Auth: none declared

First-time password set for accounts that came in through an
OAuth provider (Google today) and don't yet have a local password.

Rejects with 409 if a password already exists — the user must go
through /auth/change-password in that case, which requires the
current password. This asymmetry is the whole point: we do NOT
want a compromised Google session to be able to silently reset a
real password without knowing the current one.

Fires the same password_changed security notification the reset
and change flows use, so the user gets an audit-trail email even
for a first-time password set.

## Request body

- SetPasswordRequest: First-time password set for a user who signed up via an OAuth provider (Google today, more later). Never accepts a `current_password` — that's what /auth/change-password is for. Once a password exists on the account, this endpoint 409s and the user must go through the change flow instead.
  - `new_password` string, required

## Response `200`

Successful Response

- unknown

## Other responses

- `422`: Validation Error

---

[API](https://skmtc.dev/africadb/apis/africa-data-bank-api.md) · [All operations](https://skmtc.dev/africadb/apis/africa-data-bank-api/llms.txt) · [OpenAPI document](https://skmtc.dev/africadb/apis/africa-data-bank-api/revisions/2a50da82945b?raw)