---
title: "Reset Password"
method: POST
path: "/api/auth/reset"
tags: ["auth"]
---

# Reset Password

`POST /api/auth/reset`

## Request

- Base URL: `https://api.getcheapgames.com` (the document declares no server; this is the origin it was published from)
- URL: `https://api.getcheapgames.com/api/auth/reset`
- Auth: none declared

A reset link's new password: set, the address confirmed, every session
ended, and this browser signed in — or `totp` with a challenge, the
password set either way. `expired` or `invalid` (used, or overtaken by
a change of password or address) for a dead link, checked before the
password, so a dead link is not met with a password rule.

## Response `200`

Successful Response

- union
  - GcgAccountsSchemasSignInOut: `ok` with the user and the cookies set, or `totp` with a challenge to answer.
    - `status` 'ok' | 'totp', required
    - `user` MeOut: The signed-in account, as `/api/account/me` and every sign-in answer it.
      - `id` integer, required
      - `username` string, required
      - `email` string, nullable, required
      - `emailVerified` boolean, required
      - `twoFactor` boolean, required
      - `methods` MethodsOut, required: The ways this account can sign in.
        - `password` boolean, required
        - `google` boolean, required
        - `steam` boolean, required
        - `epic` boolean, required
      - `platforms` string[], required
      - `createdAt` string, date-time, required
    - `challenge` string, nullable
  - StatusOut: One word: the email routes say `sent` whatever the address's state.
    - `status` 'ok' | 'sent' | 'expired' | 'invalid' | 'taken', required

---

[API](https://skmtc.dev/getcheapgames/apis/getcheapgames-api.md) · [All operations](https://skmtc.dev/getcheapgames/apis/getcheapgames-api/llms.txt) · [OpenAPI document](https://skmtc.dev/getcheapgames/apis/getcheapgames-api/revisions/57333a690301?raw)