---
title: "Change Password"
method: POST
path: "/v1/auth/change-password"
---

# Change Password

`POST /v1/auth/change-password`

## Request

- Base URL: `https://api.quantradin.com` (the document declares no server; this is the origin it was published from)
- URL: `https://api.quantradin.com/v1/auth/change-password`
- Auth: none declared

Change the logged-in user's password.  Session-auth required.

Verifies current_password against the stored hash with the SAME bcrypt +
timing discipline as /login (db.verify_user_password — bcrypt.checkpw, dummy
hash on the miss path), enforces the signup length rule on new_password, and
rejects a no-op (new == current).

On success: rotates the password and REVOKES ALL OTHER sessions — every
other device/cookie is logged out so a stolen session dies with the old
password — while KEEPING the requesting session alive (the user who just
changed their password stays logged in HERE).  Returns {"ok": true}.

Failures:
  - no/invalid session   → 401 (require_session_user)
  - wrong current        → 403 "Current password is incorrect."  (deliberately
    NOT 401: a bad guess must not make the browser treat the caller as logged
    out and tear down their session state client-side)
  - invalid / no-op new  → 422 (the rule, in plain words)
  - too many attempts    → 429 (per-user brute-force guard on current_password)

## Request body

- ChangePwBody
  - `current_password` string, required
  - `new_password` string, required

## Response `200`

Successful Response

- unknown

## Other responses

- `422`: Validation Error

---

[API](https://skmtc.dev/quantradin/apis/vega-api.md) · [All operations](https://skmtc.dev/quantradin/apis/vega-api/llms.txt) · [OpenAPI document](https://skmtc.dev/quantradin/apis/vega-api/revisions/47add154ef38?raw)