---
title: "Change Password"
method: POST
path: "/auth/change-password"
tags: ["auth", "authentication"]
---

# Change Password

`POST /auth/change-password`

Change your own password, having proved you know the current one.

Returns a REPLACEMENT token. That is not a convenience, it is required:
setting `password_changed_at` revokes every token issued before it, and the
caller's own token was issued before it. Without a fresh one the user is
signed out by their own successful password change — and on the very next
request, so it reads as the change having failed.

The one-second backdate is for the same machinery. `iat` is whole seconds
(jwt encodes an int), and the check in auth_service is `token_time <
password_changed_at`. Mint the replacement in the same wall-clock second as
the change and the truncated `iat` can land a fraction BEFORE
`password_changed_at`, revoking the token we just issued. Backdating the
stamp by a second puts every genuinely-old token on the revoked side and the
new one safely on the live side.

## Headers

- `authorization` string, nullable

## Request body

- ChangePasswordRequest
  - `current_password` string, required
  - `new_password` string, required

## Response `200`

Successful Response

- unknown

## Other responses

- `422` — Validation Error

---

[API](https://skmtc.dev/fluentea/apis/aurqa-language-learning-platform-refactored.md) · [All operations](https://skmtc.dev/fluentea/apis/aurqa-language-learning-platform-refactored/llms.txt) · [OpenAPI document](https://skmtc-service-production.skmtc.workers.dev/v1/apis/fluentea/aurqa-language-learning-platform-refactored/revisions/78f314acd8bf/schema)