Change password (authenticated session)
POST/auth/users/change-password
Change the currently authenticated end user's password from a logged-in
session. The caller must prove possession of the CURRENT password
(current_password); the user is identified from the end-user token, not
the request body, so a user can only change their own password.
On success, all existing sessions are revoked and a fresh token pair is
returned so the current session stays authenticated. Emits the
user.password_changed webhook.
Request
Responses
- 200
- 400
- 401
- 500
Password changed successfully; a fresh token pair is returned.
New password does not meet requirements, or the account has no password (OAuth-only).
Missing/invalid token, or the current password is incorrect.
Internal server error