---
title: "Change password"
method: POST
path: "/users/@me/password"
tags: ["Users"]
---

# Change password

`POST /users/@me/password`

## Request

- Base URL: `https://web.fluxer.app/api/v1`
- URL: `https://web.fluxer.app/api/v1/users/@me/password`
- Auth: API key in header `Authorization`

Changes the password on instances where people sign in with a username. Requires sudo mode verification. Ends every other session, deletes the recovery kit and returns a token for a new session that replaces the current one. Fails with USERNAME_SIGN_IN_ONLY on email instances.

## Request body

- UserPasswordUpdateRequest
  - `new_password` string, required
  - `password` string
  - `mfa_method` 'totp' | 'webauthn': MFA method to use for verification
  - `mfa_code` string: MFA verification code from an authenticator app
  - `webauthn_response` WebAuthnAuthenticationResponse
    - `id` string, required
    - `rawId` string, required
    - `type` 'public-key', required
    - `authenticatorAttachment` 'cross-platform' | 'platform'
    - `clientExtensionResults` object, required
      - `appid` boolean
      - `credProps` object
        - `rk` boolean
      - `hmacCreateSecret` boolean
    - `response` object, required
      - `clientDataJSON` string, required
      - `authenticatorData` string, required
      - `signature` string, required
      - `userHandle` string
  - `webauthn_challenge` string: WebAuthn challenge string

## Response `200`

Success

- UserPasswordUpdateResponse
  - `token` string, required: Authentication token for the newly created session
  - `auth_session_id_hash` string, required: Base64url-encoded hash of the newly created authentication session

## Other responses

- `400`: Bad Request - The request was malformed or contained invalid data
- `401`: Unauthorized - Authentication is required or the token is invalid
- `403`: Forbidden - You do not have permission to perform this action
- `429`: Too Many Requests - You are being rate limited
- `500`: Internal Server Error - An unexpected error occurred

## Changes

> 39 revisions in range; 2 not diffed.

- **2026-10-06** `3af1fd7f2456`: 1 info
  - endpoint added

[Operation history](https://skmtc.dev/fluxer/apis/fluxer-api/changes/users/@me/password/post.md)

---

[API](https://skmtc.dev/fluxer/apis/fluxer-api.md) - [All operations](https://skmtc.dev/fluxer/apis/fluxer-api/llms.txt) - [OpenAPI document](https://skmtc.dev/fluxer/apis/fluxer-api/revisions/9534dbe80d92?raw)