---
title: "Reset password"
method: POST
path: "/reset-passwords"
tags: ["Customer"]
---

# Reset password

`POST /reset-passwords`

## Request

- Base URL: `http://localhost:8000/api/shop`
- URL: `http://localhost:8000/api/shop/reset-passwords`
- Auth: HTTP bearer
- TypeScript: <https://skmtc.dev/bagisto/apis/bagisto-shop-api/docs/reset-passwords/post.ts> (a function with typed inputs; its response is checked against the schema)

Sets a new password with the token from the forgot-password email. The token is the last segment of the reset link (`/customer/reset-password/{token}`). A token can be used once and expires after the time set in the auth config. No customer login is needed. The emailed link opens the storefront reset page; an app that wants its own screen should open that link as a deep link and call this endpoint.

## Headers

- `X-STOREFRONT-KEY` string, required
- `X-Locale` string
- `X-Channel` string
- `X-Currency` string

## Request body

- object
  - `token` string, required
  - `email` string, required
  - `password` string, required
  - `passwordConfirmation` string, required

## Response `201`

Password changed.

## Other responses

- `400`: Invalid input
- `422`: Missing or invalid input, or the token is invalid or expired.

## Changes

- **2026-10-28** `52d9bb5c7a63`: 1 info
  - endpoint added

[Operation history](https://skmtc.dev/bagisto/apis/bagisto-shop-api/changes/reset-passwords/post.md)

---

[API](https://skmtc.dev/bagisto/apis/bagisto-shop-api.md) - [All operations](https://skmtc.dev/bagisto/apis/bagisto-shop-api/llms.txt) - [OpenAPI document](https://skmtc.dev/bagisto/apis/bagisto-shop-api/revisions/f619df36bf29?raw)