Auth

Change the session's own password

Session-only. Validates current_password (skipped for an OAuth-only account with no password set yet), persists new_password, then revokes every OTHER session for the account and issues a fresh one for this request's cookie — a password change is how a user locks out anyone else holding a live session for the account.

An account with no password yet can set one only within 15 minutes of signing in; changing a password does not count as signing in. Outside that window the answer is 403 REAUTH_REQUIRED and nothing is saved.

This does not revoke API keys: a key holder keeps full API access across a password change. Revoking keys on password change is a separate, planned capability; a user who suspects a leaked key must revoke it via DELETE /api/v1/api-keys/{id}.

An API-key request gets 403 SESSION_ONLY, never 404. Being a write, it also requires the CSRF double-submit header: 403 CSRF_REQUIRED if X-CSRF-Token is missing or does not match the lp_csrf cookie.

post/api/v1/me/password

Request

  • Base URL: https://app.lastping.dev
  • URL: https://app.lastping.dev/api/v1/me/password
  • Auth: API key in cookie lp_session

Request body

current_passwordstring required

The account's current password. Ignored (any value accepted) for an OAuth-only account with no password set yet. Such an account proves itself with a recent sign-in instead: it can set its first password only within 15 minutes of signing in (403 REAUTH_REQUIRED otherwise).

new_passwordstring required

Example request

{
  "current_password": "correct horse battery staple",
  "new_password": "a much longer new passphrase"
}

Response

Password changed. This request's session cookie has been refreshed.

Changes

No recorded changes to this operation across all 2 revisions of this API.