---
title: "Finish a password reset with the token from the email"
method: POST
path: "/v1/auth/password/reset"
tags: ["Auth"]
---

# Finish a password reset with the token from the email

`POST /v1/auth/password/reset`

## Request

- Base URL: `https://api.briefgate.dev`
- URL: `https://api.briefgate.dev/v1/auth/password/reset`
- Auth: none required

Sets a new password from the token minted by /v1/auth/password/forgot. Every session on the account is invalidated — a stolen session must not survive the reset meant to shut it out — but API keys are left alone. No session is issued here: signing back in still goes through /v1/auth/login, which is what enforces a second factor, so a stolen reset link cannot be used to skip past TOTP.

## Request body

- ResetPassword
  - `token` string, required
  - `password` string, required

## Response `200`

Password changed

## Other responses

- `401`: Invalid or expired token
- `403`: Too many attempts
- `422`: Validation error — the body shape is correct but values are invalid

---

[API](https://skmtc.dev/briefgate/apis/briefgate-api.md) · [All operations](https://skmtc.dev/briefgate/apis/briefgate-api/llms.txt) · [OpenAPI document](https://skmtc.dev/briefgate/apis/briefgate-api/revisions/b21afed4748b?raw)