---
title: "Change Password"
method: POST
path: "/api/auth/change-password"
---

# Change Password

`POST /api/auth/change-password`

## Request

- Base URL: `https://api.drillflow.de` (the document declares no server; this is the origin it was published from)
- URL: `https://api.drillflow.de/api/auth/change-password`
- Auth: none declared

A new password while signed in. Cookie-only like delete-account: an API
token lives in an agent's config and must not be able to take the account
over. The current password is required, every OTHER session ends (the
epoch moves), this one gets a fresh cookie, and the owner gets a mail.

## Request body

- ChangePasswordRequest: The current password is the re-auth: a session left open on a shared machine must not be enough to lock its owner out.
  - `current_password` string, required
  - `new_password` string, required

## Response `200`

Successful Response

- UserResponse
  - `id` integer, required
  - `email` string, required
  - `verified` boolean, required
  - `handle` string, nullable
  - `entitlements` string[]
  - `has_password` boolean
  - `google` boolean
  - `providers` string[]

## Other responses

- `422`: Validation Error

## Changes

- **2026-10-19** `c892102e97b0`: 1 info
  - added the optional property `providers` to the response with the `200` status

[Operation history](https://skmtc.dev/drillflow/apis/drillflow-api/changes/api/auth/change-password/post.md)

---

[API](https://skmtc.dev/drillflow/apis/drillflow-api.md) · [All operations](https://skmtc.dev/drillflow/apis/drillflow-api/llms.txt) · [OpenAPI document](https://skmtc.dev/drillflow/apis/drillflow-api/revisions/c892102e97b0?raw)