Skip to main content
PUT
Set or change password

Body

application/json

A password set or change.

When the account already has a password, current_password is required and verified before the change is applied, so a hijacked session or CSRF cannot silently reset it (and lock out the real owner). When the account has no password yet (an SSO-only account setting its first one), there is nothing to re-authenticate against, so a fresh step-up reauth_proof is required instead — a live session alone must not mint a durable new credential.

A password set or change.

When the account already has a password, current_password is required and verified before the change is applied, so a hijacked session or CSRF cannot silently reset it (and lock out the real owner). When the account has no password yet (an SSO-only account setting its first one), there is nothing to re-authenticate against, so a fresh step-up reauth_proof is required instead — a live session alone must not mint a durable new credential.

newPassword
string
required

The new password (will be hashed before storage).

Required string length: 8 - 128
currentPassword
string

The account's current password. Required when the account already has a password; omitted when setting a first password on an account that has none (supply reauth_proof instead).

reauthProof
string

A step-up re-authentication proof (from the OIDC reauth endpoint). Required when setting a first password on an account that has none; ignored when changing an existing password.

Response

Password set.