---
title: "Change Password"
method: POST
path: "/api/user/change_password"
tags: ["user"]
---

# Change Password

`POST /api/user/change_password`

Change user's master password by re-keying all workspace keys.

Client must:
1. Prove knowledge of current master password via X25519 public key
2. Provide new X25519 public key (derived from new master password)
3. Re-wrap all workspace keys with new X25519 public key

Server will:
1. Verify current master password (public key comparison)
2. Update X25519 public key
3. Update all workspace wrapped keys

Note: This changes the master password (encryption password), not authentication password.
Both local and SSO users can change their master password.

## Request body

- ChangePasswordRequest
  - `current_public_key` string, required
  - `new_public_key` string, required
  - `rewrapped_workspace_keys` object, required

## Response `200`

Successful Response

- ChangePasswordResponse
  - `detail` string, required
  - `workspaces_updated` integer, required

## Other responses

- `422` — Validation Error

## Changes

- **2025-10-28** `849d5e8732f6` — 1 info
  - endpoint added

[Change history](https://skmtc.dev/arbicity/apis/arbi/changes/api/user/change_password/post.md)

---

[API](https://skmtc.dev/arbicity/apis/arbi.md) · [All operations](https://skmtc.dev/arbicity/apis/arbi/llms.txt) · [OpenAPI document](https://skmtc-service-production.skmtc.workers.dev/v1/apis/arbicity/arbi/revisions/2cd7c0e6303a/schema)