Reset Password
Auth Endpoints
Reset Password
Reset a user’s password using a token from the reset email
Reset Password
Sets a new password for a user by validating a reset token received via email.
On success, in one transaction, the server writes the new password, invalidates every refresh token for that user — including the session that asked for the reset — and deletes every push binding that user holds on every device, so notification content stops routing to a device someone else may hold. Either all three land or none does. Projects without the
Returned when the token does not match any user record or the token has
expired (1 hour TTL).
Nothing was committed — the password, the sessions and the push bindings are
all as they were, and the reset token is still usable.
Rate limit: 5 requests per 15 minutes per IP. Exceeding it returns
push bundle skip the binding step and are otherwise unaffected. The user’s own devices re-bind on their own the next time each is opened.
Access tokens are not revoked by this: one minted before the reset keeps working until it expires, up to 30 minutes. It is the refresh families that go, so no device can mint a new one.
Body Parameters
string
required
The raw reset token from the password reset email link. The server hashes
this token internally before comparing it to the stored hash.
string
required
The new password to set.
Response
boolean
true on success.string
Confirmation message:
"Password has been reset successfully."Error Responses
Invalid or Expired Token — 400
Invalid or Expired Token — 400
Server Error — 500
Server Error — 500
429 with the plain-text message Too many password reset attempts, please wait 15 minutes and no code.

