---
title: "Request Password Setup"
method: POST
path: "/auth/request-password-setup"
tags: ["auth", "authentication"]
---

# Request Password Setup

`POST /auth/request-password-setup`

Mail a set-a-password link to a signed-in OAuth user's own address.

Why this is not "just let them set one": there is no current password to
check, so a bare session would be the only thing standing between a stolen
token and permanent account takeover. Today that token dies in 24 hours;
minting a password from it would make the takeover permanent. The mailbox is
the second proof, and it is the same proof the provider used to vouch for
them in the first place.

Sending it to `current_user.email` rather than an address in the body is the
point — the caller does not get to choose where the link goes.

(When Sign in with Apple goes live this needs a second path: Apple's private
relay addresses, already detected as `is_private_email` in oauth_routes, are
mailboxes many people never read. The convention there is a fresh OAuth
bounce as the re-authentication instead of an email.)

## Headers

- `authorization` string, nullable

## Response `200`

Successful Response

- unknown

## Other responses

- `422` — Validation Error

---

[API](https://skmtc.dev/fluentea/apis/aurqa-language-learning-platform-refactored.md) · [All operations](https://skmtc.dev/fluentea/apis/aurqa-language-learning-platform-refactored/llms.txt) · [OpenAPI document](https://skmtc-service-production.skmtc.workers.dev/v1/apis/fluentea/aurqa-language-learning-platform-refactored/revisions/78f314acd8bf/schema)