Users

Change own password

Changed on

Change the authenticated user's password and return a fresh token.

A new token is required because the caller's current token still carries the stale must_change_password claim; returning a re-minted token is what actually clears the rotation gate client-side.

post/users/me:change-password

Request

  • Base URL: / (relative, and the document was published on a file host, not at the API’s origin)
  • URL: /users/me:change-password
  • Auth: one of:
    • HTTP bearer
    • OAuth 2 (authorization code, authorization URL /authorize, token URL /oauth/token)

Request body

current_passwordstring required

The caller's current password.

new_passwordstring required

The new password to set.

Example request

{
  "current_password": "example-password",
  "new_password": "example-new-password"
}

Response

Successful Response

access_tokenstring required

Signed JWT to send as a bearer token on subsequent requests.

expires_ininteger required

Lifetime of the access token in seconds.

must_change_passwordboolean required

Whether the user must change their password before using other endpoints.

token_typestring required

Token type; always bearer.

Example response

{
  "access_token": "example-access-token",
  "expires_in": 3600,
  "must_change_password": false,
  "token_type": "bearer"
}

Changes