---
title: "Change (or set) the signed-in user's password"
method: POST
path: "/v1/auth/password/change"
tags: ["Auth"]
---

# Change (or set) the signed-in user's password

`POST /v1/auth/password/change`

## Request

- Base URL: `https://api.briefgate.dev`
- URL: `https://api.briefgate.dev/v1/auth/password/change`
- Auth: HTTP bearer

`current_password` is required and checked when the account already has a password. A Google-only account has none, so this sets the first password instead of changing one — the session itself is the proof of ownership in that case. Every OTHER session on the account is invalidated; the one making this call keeps working.

## Request body

- ChangePassword
  - `current_password` string
  - `new_password` string, required

## Response `200`

Password changed

## Other responses

- `400`: current_password missing on an account that already has one
- `401`: current_password is wrong, or not authenticated
- `422`: Validation error — the body shape is correct but values are invalid

---

[API](https://skmtc.dev/briefgate/apis/briefgate-api.md) · [All operations](https://skmtc.dev/briefgate/apis/briefgate-api/llms.txt) · [OpenAPI document](https://skmtc.dev/briefgate/apis/briefgate-api/revisions/b21afed4748b?raw)