Change Password
curl --request POST \
--url https://api.sublay.io/v8/:projectId/auth/change-password \
--header 'Authorization: Bearer <token>' \
--header 'Content-Type: application/json' \
--data '
{
"password": "<string>",
"newPassword": "<string>",
"pushDevice": {},
"userId": "<string>"
}
'import requests
url = "https://api.sublay.io/v8/:projectId/auth/change-password"
payload = {
"password": "<string>",
"newPassword": "<string>",
"pushDevice": {},
"userId": "<string>"
}
headers = {
"Authorization": "Bearer <token>",
"Content-Type": "application/json"
}
response = requests.post(url, json=payload, headers=headers)
print(response.text)const options = {
method: 'POST',
headers: {Authorization: 'Bearer <token>', 'Content-Type': 'application/json'},
body: JSON.stringify({
password: '<string>',
newPassword: '<string>',
pushDevice: {},
userId: '<string>'
})
};
fetch('https://api.sublay.io/v8/:projectId/auth/change-password', options)
.then(res => res.json())
.then(res => console.log(res))
.catch(err => console.error(err));<?php
$curl = curl_init();
curl_setopt_array($curl, [
CURLOPT_URL => "https://api.sublay.io/v8/:projectId/auth/change-password",
CURLOPT_RETURNTRANSFER => true,
CURLOPT_ENCODING => "",
CURLOPT_MAXREDIRS => 10,
CURLOPT_TIMEOUT => 30,
CURLOPT_HTTP_VERSION => CURL_HTTP_VERSION_1_1,
CURLOPT_CUSTOMREQUEST => "POST",
CURLOPT_POSTFIELDS => json_encode([
'password' => '<string>',
'newPassword' => '<string>',
'pushDevice' => [
],
'userId' => '<string>'
]),
CURLOPT_HTTPHEADER => [
"Authorization: Bearer <token>",
"Content-Type: application/json"
],
]);
$response = curl_exec($curl);
$err = curl_error($curl);
curl_close($curl);
if ($err) {
echo "cURL Error #:" . $err;
} else {
echo $response;
}package main
import (
"fmt"
"strings"
"net/http"
"io"
)
func main() {
url := "https://api.sublay.io/v8/:projectId/auth/change-password"
payload := strings.NewReader("{\n \"password\": \"<string>\",\n \"newPassword\": \"<string>\",\n \"pushDevice\": {},\n \"userId\": \"<string>\"\n}")
req, _ := http.NewRequest("POST", url, payload)
req.Header.Add("Authorization", "Bearer <token>")
req.Header.Add("Content-Type", "application/json")
res, _ := http.DefaultClient.Do(req)
defer res.Body.Close()
body, _ := io.ReadAll(res.Body)
fmt.Println(string(body))
}HttpResponse<String> response = Unirest.post("https://api.sublay.io/v8/:projectId/auth/change-password")
.header("Authorization", "Bearer <token>")
.header("Content-Type", "application/json")
.body("{\n \"password\": \"<string>\",\n \"newPassword\": \"<string>\",\n \"pushDevice\": {},\n \"userId\": \"<string>\"\n}")
.asString();require 'uri'
require 'net/http'
url = URI("https://api.sublay.io/v8/:projectId/auth/change-password")
http = Net::HTTP.new(url.host, url.port)
http.use_ssl = true
request = Net::HTTP::Post.new(url)
request["Authorization"] = 'Bearer <token>'
request["Content-Type"] = 'application/json'
request.body = "{\n \"password\": \"<string>\",\n \"newPassword\": \"<string>\",\n \"pushDevice\": {},\n \"userId\": \"<string>\"\n}"
response = http.request(request)
puts response.read_body{
"success": true,
"message": "<string>"
}Auth Endpoints
Change Password
Change the authenticated user’s password
Change Password
curl --request POST \
--url https://api.sublay.io/v8/:projectId/auth/change-password \
--header 'Authorization: Bearer <token>' \
--header 'Content-Type: application/json' \
--data '
{
"password": "<string>",
"newPassword": "<string>",
"pushDevice": {},
"userId": "<string>"
}
'import requests
url = "https://api.sublay.io/v8/:projectId/auth/change-password"
payload = {
"password": "<string>",
"newPassword": "<string>",
"pushDevice": {},
"userId": "<string>"
}
headers = {
"Authorization": "Bearer <token>",
"Content-Type": "application/json"
}
response = requests.post(url, json=payload, headers=headers)
print(response.text)const options = {
method: 'POST',
headers: {Authorization: 'Bearer <token>', 'Content-Type': 'application/json'},
body: JSON.stringify({
password: '<string>',
newPassword: '<string>',
pushDevice: {},
userId: '<string>'
})
};
fetch('https://api.sublay.io/v8/:projectId/auth/change-password', options)
.then(res => res.json())
.then(res => console.log(res))
.catch(err => console.error(err));<?php
$curl = curl_init();
curl_setopt_array($curl, [
CURLOPT_URL => "https://api.sublay.io/v8/:projectId/auth/change-password",
CURLOPT_RETURNTRANSFER => true,
CURLOPT_ENCODING => "",
CURLOPT_MAXREDIRS => 10,
CURLOPT_TIMEOUT => 30,
CURLOPT_HTTP_VERSION => CURL_HTTP_VERSION_1_1,
CURLOPT_CUSTOMREQUEST => "POST",
CURLOPT_POSTFIELDS => json_encode([
'password' => '<string>',
'newPassword' => '<string>',
'pushDevice' => [
],
'userId' => '<string>'
]),
CURLOPT_HTTPHEADER => [
"Authorization: Bearer <token>",
"Content-Type: application/json"
],
]);
$response = curl_exec($curl);
$err = curl_error($curl);
curl_close($curl);
if ($err) {
echo "cURL Error #:" . $err;
} else {
echo $response;
}package main
import (
"fmt"
"strings"
"net/http"
"io"
)
func main() {
url := "https://api.sublay.io/v8/:projectId/auth/change-password"
payload := strings.NewReader("{\n \"password\": \"<string>\",\n \"newPassword\": \"<string>\",\n \"pushDevice\": {},\n \"userId\": \"<string>\"\n}")
req, _ := http.NewRequest("POST", url, payload)
req.Header.Add("Authorization", "Bearer <token>")
req.Header.Add("Content-Type", "application/json")
res, _ := http.DefaultClient.Do(req)
defer res.Body.Close()
body, _ := io.ReadAll(res.Body)
fmt.Println(string(body))
}HttpResponse<String> response = Unirest.post("https://api.sublay.io/v8/:projectId/auth/change-password")
.header("Authorization", "Bearer <token>")
.header("Content-Type", "application/json")
.body("{\n \"password\": \"<string>\",\n \"newPassword\": \"<string>\",\n \"pushDevice\": {},\n \"userId\": \"<string>\"\n}")
.asString();require 'uri'
require 'net/http'
url = URI("https://api.sublay.io/v8/:projectId/auth/change-password")
http = Net::HTTP.new(url.host, url.port)
http.use_ssl = true
request = Net::HTTP::Post.new(url)
request["Authorization"] = 'Bearer <token>'
request["Content-Type"] = 'application/json'
request.body = "{\n \"password\": \"<string>\",\n \"newPassword\": \"<string>\",\n \"pushDevice\": {},\n \"userId\": \"<string>\"\n}"
response = http.request(request)
puts response.read_body{
"success": true,
"message": "<string>"
}Changes the password for the currently authenticated user. The user must provide their current password for verification. Requires a valid access token in the
Existing access tokens are not revoked by this: an access token minted before the change keeps
working until it expires, up to 30 minutes. It is the refresh families that go, so no other device
can mint a new one.
Returned when a required field is missing, when
Returned when a service/master key calls this route without naming a
Returned when an end-user token names a
Nothing was committed — the password, the sessions and the push bindings are all
as they were.
Rate limit: 5 requests per 5 minutes per IP. Exceeding it returns
Authorization header.
This endpoint is only available to users who signed up with email and password.
OAuth-only users who have no password will receive a
400 error.What a password change ends
A password change is what someone reaches for when they think their account has been taken, so it ends sessions rather than only rotating a secret. In one transaction, the server:- writes the new password;
- deletes every push binding this user holds, on every device, so notification content stops
routing to a device an intruder may hold — except the device named by the optional
pushDevicefield below. Projects without thepushbundle skip this step and are otherwise unaffected; - destroys every refresh-token family for this user except the caller’s own.
The caller’s own session survives, and nothing has to be sent for that. The access token this
route is authenticated by carries the id of the session it was minted from, so the server can tell
which of the user’s sessions is asking. The user stays signed in where they are standing; every
other device must sign in again with the new password.A service or master key is not a session, so a call made with one has nothing to spare and
ends every session for the user.
Name your device or it stops notifying. Nothing re-binds a device to push from its live
session — repair happens on a cold start, an account switch or a token rotation, which on a
resident mobile app can be days away. So a client that does not send
pushDevice keeps its
session but loses its notifications until one of those happens.Body Parameters
string
required
The user’s current password.
string
required
The new password. Must be different from the current password.
object
The physical device making the call, so its push binding survives while every other device
this user is bound to loses theirs.The same shape Register Device and
Sign Out take:
{ platform: "ios" | "android", token } for
native, { platform: "web", subscription } for Web Push. It only ever spares a binding belonging
to this user, so it cannot keep another account’s binding alive on a shared device.Omit it and every binding for the user is deleted, this device’s included.string
The acting user. Service/master keys only — an end-user token infers it from the access token
and may not name a different user.
Response
boolean
true on success.string
Confirmation message:
"Password updated successfully."Error Responses
User Not Found — 403
User Not Found — 403
{
"error": "User not found.",
"code": "auth/no-user-found"
}
Not Password Authenticated — 400
Not Password Authenticated — 400
{
"error": "User is not authenticated with email and password.",
"code": "auth/not-password-authenticated"
}
Wrong Password — 401
Wrong Password — 401
{
"error": "Incorrect password.",
"code": "auth/wrong-password"
}
Invalid Body — 400
Invalid Body — 400
{ "error": "...", "code": "auth/invalid-body" }
newPassword fails the password
rules, when newPassword equals password, or when pushDevice is malformed —
for example platform: "ios" with no token.Missing User ID — 400
Missing User ID — 400
{ "error": "Missing user ID", "code": "auth/missing-user-id" }
userId.Acting As Another User — 403
Acting As Another User — 403
{ "error": "Unauthorized", "code": "auth/unauthorized" }
userId other than its own.Server Error — 500
Server Error — 500
{
"error": "Internal server error.",
"code": "auth/server-error"
}
429 with the plain-text message Too many attempts to change password, please wait 5 minutes and no code.
See Also
useAuthhook —changePassword- Built-in Auth guide

