---
title: "Set or change the Bearer actor's password"
method: POST
path: "/auth/v1/account/password"
tags: ["Auth"]
---

# Set or change the Bearer actor's password

`POST /auth/v1/account/password`

## Request

- Base URL: `https://api.run402.com`
- URL: `https://api.run402.com/auth/v1/account/password`
- Auth: API key in header `apikey` and HTTP bearer

Machine route (apikey + user Bearer). Requires the signed auth_time claim to be no more than 5 minutes old; otherwise returns R402_AUTH_FRESHNESS_REQUIRED. Refresh-token rotation preserves auth_time and does not satisfy freshness. A successful change revokes all of the user's browser sessions.

## Request body

- object
  - `new_password` string, required: New password, limited to 72 UTF-8 bytes.

## Response `200`

Password changed and browser sessions revoked.

- object
  - `ok` true, required
  - `sessions_revoked` integer, required

## Other responses

- `400`: Invalid request body.
- `401`: Missing or invalid authentication. Run402-originated JSON bodies use the canonical ErrorEnvelope.

---

[API](https://skmtc.dev/run402/apis/run402-api.md) · [All operations](https://skmtc.dev/run402/apis/run402-api/llms.txt) · [OpenAPI document](https://skmtc.dev/run402/apis/run402-api/revisions/893607557f50?raw)