Change the authenticated identity's password

PATCH

/current-identity-password

Changes the password on the email-password auth method belonging to the currently authenticated identity. The caller must prove they still control the account by supplying the current_password; it is verified against the stored hash before the new_password is accepted. To guard against brute-forcing the current password, failed verification attempts are tracked per auth method and the endpoint locks out further attempts (see the 429 response) once a threshold is exceeded within a rolling window. As a security measure, every one of the identity's active sessions is terminated immediately after the password is changed, forcing re-authentication everywhere (including the session used to make this request).

Request

Authorization

JWT Bearer

Add the parameter

Authorization

to Headers

Example:

Authorization: ********************

Body Params application/jsonRequired

Examples

Responses

🟢200

application/json

The password was changed successfully and all of the identity's active sessions, including the one used to make this request, have been terminated.

Bodyapplication/json

🟠400

🟠401

🟠404

🟠429

Request Example

Shell

JavaScript

Java

Swift

curl --location --request PATCH '/current-identity-password' \
--header 'Authorization: Bearer <token>' \
--header 'Content-Type: application/json' \
--data-raw '{
    "current_password": "oldSecureP@ss1",
    "new_password": "n3wSecureP@ssw0rd!"
}'

Response Example

200 - Success

{
    "message": "Request successful",
    "status": "success",
    "data": {
        "success": true
    }
}

Modified at 2026-09-30 00:29:45

Complete a password reset with a one-time token

Confirm a pending email address change