---
title: "Set a new password and revoke existing sessions"
method: POST
path: "/auth/password-resets/confirm"
tags: ["Auth"]
---

# Set a new password and revoke existing sessions

`POST /auth/password-resets/confirm`

## Request

- Base URL: `https://api.flashdata.dev/v2`
- URL: `https://api.flashdata.dev/v2/auth/password-resets/confirm`
- Auth: none required

Atomically consumes the password-reset token, stores a new Argon2id credential, revokes every existing Session, and invalidates other password-reset tokens. It does not log the user in or create a Session.

## Request body

- object
  - `token` string, required
  - `password` string, required

## Response `204`

Password updated; existing sessions revoked

## Other responses

- `410`: One-time token is invalid, expired, invalidated, already used, or lost a concurrent confirmation race. Problem.code is `token_unavailable`.
- `422`: Anonymous authentication request validation failed
- `429`: Anonymous authentication rate limit exceeded
- `500`: An unexpected anonymous authentication error occurred
- `503`: An anonymous authentication dependency is temporarily unavailable

---

[API](https://skmtc.dev/flashdata/apis/flashdata-customer-api.md) · [All operations](https://skmtc.dev/flashdata/apis/flashdata-customer-api/llms.txt) · [OpenAPI document](https://skmtc.dev/flashdata/apis/flashdata-customer-api/revisions/109179fe9313?raw)