---
title: "Set a new password from a reset link"
method: POST
path: "/auth/password-reset/confirm"
---

# Set a new password from a reset link

`POST /auth/password-reset/confirm`

## Request

- Base URL: `https://api.eurobase.dev`
- URL: `https://api.eurobase.dev/auth/password-reset/confirm`
- Auth: none declared

Replaces the password, marks the email verified, and revokes every session, linked provider identity, unused provider login handoff and CLI credential of the account. Does not sign in.

## Request body

- PasswordResetConfirmation
  - `token` string, required
  - `password` string, required

## Response `200`

Password replaced

- PasswordResetConfirmationResponse
  - `ok` true, required
  - `status` 'reset', required
  - `providerSignInsDisconnected` boolean, required: Whether the reset removed at least one linked Google or GitHub sign-in

## Other responses

- `400`: The link cannot be used, or the new password is outside the policy
- `429`: Persistent per-link confirmation limit exceeded
- `503`: Password hashing capacity is busy; retry without losing entered input

---

[API](https://skmtc.dev/eurobase/apis/eurobase-api.md) · [All operations](https://skmtc.dev/eurobase/apis/eurobase-api/llms.txt) · [OpenAPI document](https://skmtc.dev/eurobase/apis/eurobase-api/revisions/5266a299d18a?raw)