---
title: "Change the session's own password"
method: POST
path: "/api/v1/me/password"
tags: ["Auth"]
---

# Change the session's own password

`POST /api/v1/me/password`

## Request

- Base URL: `https://app.lastping.dev`
- URL: `https://app.lastping.dev/api/v1/me/password`
- Auth: API key in cookie `lp_session`

**Session-only.** Validates `current_password` (skipped for an
OAuth-only account with no password set yet), persists
`new_password`, then revokes every OTHER session for the account and
issues a fresh one for this request's cookie — a password change is
how a user locks out anyone else holding a live session for the
account.

An account with no password yet can set one only within 15 minutes
of signing in; changing a password does not count as signing in.
Outside that window the answer is 403 `REAUTH_REQUIRED` and nothing
is saved.

This does **not** revoke API keys: a key holder keeps full API
access across a password change. Revoking keys on password change is
a separate, planned capability; a user who suspects a leaked key
must revoke it via `DELETE /api/v1/api-keys/{id}`.

An API-key request gets 403 `SESSION_ONLY`, never 404. Being a
write, it also requires the CSRF double-submit header: 403
`CSRF_REQUIRED` if `X-CSRF-Token` is missing or does not match the
`lp_csrf` cookie.

## Request body

- ChangePasswordRequest: Body for POST /api/v1/me/password.
  - `current_password` string, required: The account's current password. Ignored (any value accepted) for an OAuth-only account with no password set yet. Such an account proves itself with a recent sign-in instead: it can set its first password only within 15 minutes of signing in (403 `REAUTH_REQUIRED` otherwise).
  - `new_password` string, required

## Response `204`

Password changed. This request's session cookie has been refreshed.

## Other responses

- `400`: `INVALID_PASSWORD` — new_password was not 8-200 characters — or `WRONG_PASSWORD` — current_password did not match.
- `403`: The request used an API key rather than a session cookie (`SESSION_ONLY`), the session request was missing a valid `X-CSRF-Token` header (`CSRF_REQUIRED`), or the account has no password yet and this session carries no sign-in within the last 15 minutes (`REAUTH_REQUIRED`; sign in again, then set it).
- `429`: Too many requests. The per-principal fixed-window rate limit has been exceeded. Retry after the number of seconds indicated by the `Retry-After` response header. The problem body's `code` is `RATE_LIMITED`. It names this limiter specifically, so a client can tell it apart from the application-level throttles that also answer 429 with their own codes and their own, much longer, `Retry-After` values (`TEST_PING_RATE_LIMITED`, `TOO_MANY_ATTEMPTS`). Back off globally on `RATE_LIMITED`; back off on the one operation for the others. The principal is the API key for a key-authenticated request and the USER for a browser session, so every tab one person has open shares one budget.

---

[API](https://skmtc.dev/lastping/apis/lastping-management-api.md) · [All operations](https://skmtc.dev/lastping/apis/lastping-management-api/llms.txt) · [OpenAPI document](https://skmtc.dev/lastping/apis/lastping-management-api/revisions/bbc6eda91c46?raw)