Complete a password reset with a one-time token

PATCH

/password-resets

Consumes a single-use password-reset token (previously emailed via POST /password-resets) and sets a new password for the identity it belongs to. The token is marked as used as part of this call, so it cannot be replayed. As a security measure, every active session belonging to the identity is terminated immediately after the password is changed, forcing re-authentication everywhere. This endpoint is intentionally unauthenticated — the token itself proves the caller controls the associated email inbox.

Request

Body Params application/jsonRequired

Examples

Responses

🟢200

application/json

The password was reset successfully and all of the identity's active sessions have been terminated.

Bodyapplication/json

🟠400

🟠404

Request Example

Shell

JavaScript

Java

Swift

curl --location --request PATCH '/password-resets' \
--header 'Content-Type: application/json' \
--data-raw '{
    "token": "a1b2c3d4e5f6789012345678901234567890abcdef1234567890abcdef1234",
    "new_password": "n3wSecureP@ssw0rd!"
}'

Response Example

200 - Success

{
    "message": "Request successful",
    "status": "success",
    "data": {
        "success": true
    }
}

Modified at 2026-09-28 12:45:48

Request a password reset

Change the authenticated identity's password