---
title: "Set or change the app-lock PIN"
method: POST
path: "/auth/app-lock"
tags: ["auth"]
---

# Set or change the app-lock PIN

`POST /auth/app-lock`

Requires `currentPin` when a lock already exists. A wrong `currentPin` counts against the same attempt budget as the lock screen — otherwise an unlocked session could guess the PIN without limit and learn it for every future lock.

## Request body

- SetAppLockDto
  - `pin` string, required — The new PIN, 4-6 digits. Its length is what the client renders from later; a separate length field is not accepted, because two values that can disagree is a bug rather than a convenience.
  - `currentPin` string — Required when a lock already exists. Changing a PIN proves knowledge of the current one, and a wrong value counts against the same attempt budget as the lock screen — otherwise an unlocked session is an unlimited PIN oracle.

## Response `204`

PIN set

## Other responses

- `401` — Incorrect current PIN
- `403` — Attempts exhausted
- `423` — Session is locked

---

[API](https://skmtc.dev/dre/apis/dre-api.md) · [All operations](https://skmtc.dev/dre/apis/dre-api/llms.txt) · [OpenAPI document](https://skmtc-service-production.skmtc.workers.dev/v1/apis/dre/dre-api/revisions/5d14beb9482b/schema)