---
title: "Changes a user's password from the password reset flow."
method: POST
path: "/api/auth/password/reset/change"
tags: ["Authentication"]
deprecated: true
---

# Changes a user's password from the password reset flow.

`POST /api/auth/password/reset/change`

## Request

- Base URL: `https://passivelogic.com` (the document declares no server; this is the origin it was published from)
- URL: `https://passivelogic.com/api/auth/password/reset/change`
- Auth: one of:
  - API key in header `X-PL-AUTH`
  - API key in header `Authorization: PL-API-KEY`
  - API key in header `PL-API-KEY`
  - HTTP basic
- TypeScript: <https://skmtc.dev/passivelogic/apis/passivelogic-http-api/docs/api/auth/password/reset/change/post.ts> (a function with typed inputs; its response is checked against the schema)

> **Deprecated.**

DEPRECATED: This endpoint is not available when Keycloak authentication is turned on and will be removed in the future.

Changes a user's password to the specified value, reached from password reset flow.

Token authentication required, only using the authentication JWT decoded from the password reset URL sent to a user
from a reset initiation.

## Request body

- ChangePasswordData: Information required to change a user's password from the reset password flow
  - `newPassword` string, required: New password for the user.
  - `confirmNewPassword` string, nullable

## Response `200`

OK

- GenericMessageResponse: Generic response information
  - `message` string, required: Informative message relating to the specific response

---

[API](https://skmtc.dev/passivelogic/apis/passivelogic-http-api.md) - [All operations](https://skmtc.dev/passivelogic/apis/passivelogic-http-api/llms.txt) - [OpenAPI document](https://skmtc.dev/passivelogic/apis/passivelogic-http-api/revisions/4c47fa1d2564?raw)