Skip to main content
Reset Password
Sets a new password for a user by validating a reset token received via email. On success, in one transaction, the server writes the new password, invalidates every refresh token for that user — including the session that asked for the reset — and deletes every push binding that user holds on every device, so notification content stops routing to a device someone else may hold. Either all three land or none does. Projects without the push bundle skip the binding step and are otherwise unaffected. The user’s own devices re-bind on their own the next time each is opened. Access tokens are not revoked by this: one minted before the reset keeps working until it expires, up to 30 minutes. It is the refresh families that go, so no device can mint a new one.

Body Parameters

string
required
The raw reset token from the password reset email link. The server hashes this token internally before comparing it to the stored hash.
string
required
The new password to set.

Response

boolean
true on success.
string
Confirmation message: "Password has been reset successfully."

Error Responses

Returned when the token does not match any user record or the token has expired (1 hour TTL).
Nothing was committed — the password, the sessions and the push bindings are all as they were, and the reset token is still usable.
Every session for the user is revoked and every push binding they hold is removed, on every device. The user signs in again everywhere, and each device re-binds for push on its own once it is next opened.
Rate limit: 5 requests per 15 minutes per IP. Exceeding it returns 429 with the plain-text message Too many password reset attempts, please wait 15 minutes and no code.

See Also