POST
Reset my password
No sign-in needed For: Everyone Conditions
  • No sign-in is needed. This route has no rate limit of its own.
  • The token and the email must match a reset request made with forgot-password, and the token must be less than 60 minutes old; otherwise the call is refused with a 400.
  • The new password must be sent twice (password and password_confirmation) and have at least 8 characters with lower case, upper case, a digit and a symbol.
What else happens
  • Stores the new password and consumes the reset token.
  • Ends every session of the person in all spaces.
Part of Sign up and sign in.

Authorizations

Authorization
string
header
required

Bearer authentication header of the form Bearer <token>, where <token> is your auth token.

Body

application/json
token
string
required

Reset token received in the email sent by forgot-password. Valid for 60 minutes.

email
string<email>
required

Email address of the account, the same one the reset email was sent to.

Maximum string length: 255
password
string
required

New password: at least 8 characters with lower case, upper case, a digit and a symbol. Must equal password_confirmation.

password_confirmation
string
required

The new password repeated; must equal password.

Response

message
string
required

Confirmation text in the language of the request. Not meant to be parsed.