---
title: "Reset password using a recovery token"
method: POST
path: "/auth/recovery/reset"
tags: ["auth"]
---

# Reset password using a recovery token

`POST /auth/recovery/reset`

## Request body

- object
  - `recoveryToken` string, required
  - `password` string, required
  - `confirm` string

## Response `200`

OK

- object
  - `success` true, required
  - `msg` string, required

## Other responses

- `500` — Internal server error

## Changes

- **2026-05-01** `39082d385dda` — 3 breaking, 4 warning, 5 info
  - the `password` request property's minLength was increased from `0` to `8`
  - the `recoveryToken` request property's minLength was increased from `0` to `1`
  - added the pattern `^(?=.*[a-z])(?=.*[A-Z])(?=.*[0-9])(?=.*[!?@#$%^&*()\-_=+[\]{};:'",.~`|\\/])[A-Za-z0-9!?@#$%^&*()\-_=+[\]{};:'",.~`|\\/]+$` to the request property `password`
  - removed the optional property `data` from the response with the `200` status
  - …8 more
- **2025-08-11** `db719f9e3d34` — 2 breaking, 9 info
  - request body became required
  - the `password` request property type/format changed from `string`/`` to `string`/`password`
  - added the non-success response with the status `400`
  - removed the non-success response with the status `422`
  - …7 more
- **2025-04-20** `b97ec6888b3c` — 4 breaking, 2 warning, 9 info
  - the response property `msg` became optional for the status `200`
  - the response property `msg` became optional for the status `500`
  - the response property `success` became optional for the status `200`
  - the response property `success` became optional for the status `500`
  - …11 more

[Change history](https://skmtc.dev/bluewave-labs/apis/checkmate-api/changes/auth/recovery/reset/post.md)

---

[API](https://skmtc.dev/bluewave-labs/apis/checkmate-api.md) · [All operations](https://skmtc.dev/bluewave-labs/apis/checkmate-api/llms.txt) · [OpenAPI document](https://skmtc-service-production.skmtc.workers.dev/v1/apis/bluewave-labs/checkmate-api/revisions/a9ac59e12c59/schema)