Set or change password
Sets or changes the account’s password. Changing an existing password requires the current password; setting a first password on an account that has none requires a step-up re-authentication proof.
Body
A password set or change.
When the account already has a password, current_password is required and
verified before the change is applied, so a hijacked session or CSRF cannot
silently reset it (and lock out the real owner). When the account has no
password yet (an SSO-only account setting its first one), there is nothing to
re-authenticate against, so a fresh step-up reauth_proof is required instead
— a live session alone must not mint a durable new credential.
A password set or change.
When the account already has a password, current_password is required and
verified before the change is applied, so a hijacked session or CSRF cannot
silently reset it (and lock out the real owner). When the account has no
password yet (an SSO-only account setting its first one), there is nothing to
re-authenticate against, so a fresh step-up reauth_proof is required instead
— a live session alone must not mint a durable new credential.
The new password (will be hashed before storage).
8 - 128The account's current password. Required when the account already has a
password; omitted when setting a first password on an account that has
none (supply reauth_proof instead).
A step-up re-authentication proof (from the OIDC reauth endpoint). Required when setting a first password on an account that has none; ignored when changing an existing password.
Response
Password set.