---
title: "Change Password"
method: POST
path: "/api/user/change_password"
tags: ["user"]
---

# Change Password

`POST /api/user/change_password`

Change user's master password by re-keying all workspace keys.

Client must:
1. Sign "email|timestamp" with current Ed25519 key (proves current password)
2. Provide new Ed25519 signing key (derived from new password)
3. Re-wrap all workspace keys with new X25519 public key

Server will:
1. Verify signature with stored signing_key_pub
2. Derive new X25519 encryption key from new Ed25519 signing key
3. Update both keys and all workspace wrapped keys

Note: This changes the master password (encryption password), not authentication password.
Both local and SSO users can change their master password.

## Request body

- ChangePasswordRequest — Password change request with signature-based auth. Client proves knowledge of current password by signing with Ed25519 key. Server derives new X25519 encryption key from new Ed25519 signing key.
  - `signature` string, required
  - `timestamp` integer, required
  - `new_signing_key` string, required
  - `rewrapped_workspace_keys` object, required

## Response `200`

Successful Response

- ChangePasswordResponse
  - `detail` string, required
  - `workspaces_updated` integer, required

## Other responses

- `422` — Validation Error

## Changes

- **2025-12-25** `aa4b06f8dede` — 3 breaking, 2 warning
  - added the new required request property `new_signing_key`
  - added the new required request property `signature`
  - added the new required request property `timestamp`
  - removed the request property `current_public_key`
  - …1 more
- **2025-10-28** `849d5e8732f6` — 1 info
  - endpoint added

[Change history](https://skmtc.dev/arbicity/apis/arbi/changes/api/user/change_password/post.md)

---

[API](https://skmtc.dev/arbicity/apis/arbi.md) · [All operations](https://skmtc.dev/arbicity/apis/arbi/llms.txt) · [OpenAPI document](https://skmtc-service-production.skmtc.workers.dev/v1/apis/arbicity/arbi/revisions/1f956ac3d1c1/schema)