---
title: "Change user password"
method: POST
path: "/user/password"
tags: ["user"]
---

# Change user password

`POST /user/password`

Change the user's password. The user must be authenticated with elevated permissions or provide a valid password reset ticket.

All of the user's existing sessions are revoked atomically as part of this operation, including the session used to make the request. Clients must treat the user as signed out after a successful response and obtain a new session via sign-in.

## Request body

- UserPasswordRequest
  - `newPassword` string, required — A password of minimum 3 characters
  - `ticket` string — Ticket to reset the password, required if the user is not authenticated

## Response `200`

Password changed successfully

- 'OK'

## Other responses

- `default` — An error occurred while processing the request

## Changes

- **2026-06-24** `0fc5fd589dbf` — 1 warning
  - added the new `otp-too-many-attempts` enum value to the `error` response property for the response status `default`
- **2026-04-20** `b39086c84b43` — 1 warning, 1 info
  - added the new `user-already-exists` enum value to the `error` response property for the response status `default`
  - removed the `email-already-in-use` enum value from the `error` response property for the response status `default`
- **2025-11-11** `484d9f1a422a` — 1 warning
  - added the new `provider-account-already-linked` enum value to the `error` response property for the response status `default`
- **2025-10-09** `2bb5c4e40463` — 1 warning, 3 info
  - added the new `email-already-in-use` enum value to the `error` response property for the response status `default`
  - removed the `otp-too-many-attempts` enum value from the `error` response property for the response status `default`
  - removed the `provider-account-already-linked` enum value from the `error` response property for the response status `default`
  - removed the `user-already-exists` enum value from the `error` response property for the response status `default`

[Change history](https://skmtc.dev/nhost/apis/nhost-authentication-api/changes/user/password/post.md)

---

[API](https://skmtc.dev/nhost/apis/nhost-authentication-api.md) · [All operations](https://skmtc.dev/nhost/apis/nhost-authentication-api/llms.txt) · [OpenAPI document](https://skmtc-service-production.skmtc.workers.dev/v1/apis/nhost/nhost-authentication-api/revisions/a5c0d88b55c4/schema)