---
title: "Set a new password with the token from a reset link. No credential. The token works once; every session of the user is revoked"
method: POST
path: "/v1/auth/password-reset/confirm"
---

# Set a new password with the token from a reset link. No credential. The token works once; every session of the user is revoked

`POST /v1/auth/password-reset/confirm`

## Request

- Base URL: `https://api.evictionsapi.com`
- URL: `https://api.evictionsapi.com/v1/auth/password-reset/confirm`
- Auth: none required

## Request body

- object
  - `token` string, required
  - `password` string, required

## Response `200`

The password was changed and every session of the user was revoked. Sign in again with the new password. An `Idempotency-Key` header is ignored.

- object
  - `ok` unknown, required

## Other responses

- `400`: `invalid_reset_token`: the token is unknown, already used or expired. `invalid_request`: the password is not 10 to 200 characters (`details.issues` names `password`).
- `413`: The request body is too large.
- `429`: Too many password reset requests from this address: at most 10 every 10 minutes, counting both reset endpoints. `Retry-After` gives the seconds to wait.
- `503`: `busy`: too many password checks are waiting. Nothing was changed and the token is still unused. `Retry-After: 5` gives the seconds to wait; try again.

---

[API](https://skmtc.dev/evictionsapi/apis/evictions-api.md) · [All operations](https://skmtc.dev/evictionsapi/apis/evictions-api/llms.txt) · [OpenAPI document](https://skmtc.dev/evictionsapi/apis/evictions-api/revisions/28459213a1a3?raw)