Sign in
auth

Set Dashboard Password

Set or change the password the caller signs in to the dashboard with.

Always the caller's own identity. Supply email when it has no sign-in address yet, which is the state first boot leaves the operator in, and current_password when it already has a password and the request is authenticated by the session cookie. The master key in a header is what excuses current_password, which is how a forgotten password is recovered; it does not excuse email, because an identity with no address has nothing to sign in with whoever is asking. The operator setting a password for the first time retires master-key sign-in on this deployment.

Every other session this identity holds ends, the caller's own excepted, so a cookie stolen before the change does not outlive it.

put/v1/auth/password

Request body

current_passwordstring nullable

The password being replaced. Required when the identity already has one and the request is authenticated by the session cookie; ignored when the master key is sent in a header, which needs no proof of the old password (it still needs email when the identity has no sign-in address yet).

emailstring nullable

The address to sign in with. Required when the identity has none, which is the state first boot leaves the operator in, including when the master key is what authenticates the call. Resubmitting the address the identity already holds is accepted and ignored; only a different address is refused, because changing one is not supported yet.

new_passwordstring required

The password to sign in with from now on. At least 8 characters, and at most 72 bytes, which is bcrypt's ceiling.

Example request

{
  "email": "operator@example.com",
  "new_password": "a-real-password"
}

Response

Successful Response

emailstring required

The address this identity signs in with.

master_key_sign_in_retiredboolean required

Whether POST /v1/auth/session has stopped accepting the master key as a dashboard login. True once the operator identity has a password, which is what claiming the deployment means; a member setting their own password leaves an unclaimed deployment on the master key. Either way the master key stays the credential for the management API.

Changes