Reset Password
curl --request POST \
--url https://api.sublay.io/v8/:projectId/auth/reset-password \
--header 'Authorization: Bearer <token>' \
--header 'Content-Type: application/json' \
--data '
{
"token": "<string>",
"newPassword": "<string>"
}
'import requests
url = "https://api.sublay.io/v8/:projectId/auth/reset-password"
payload = {
"token": "<string>",
"newPassword": "<string>"
}
headers = {
"Authorization": "Bearer <token>",
"Content-Type": "application/json"
}
response = requests.post(url, json=payload, headers=headers)
print(response.text)const options = {
method: 'POST',
headers: {Authorization: 'Bearer <token>', 'Content-Type': 'application/json'},
body: JSON.stringify({token: '<string>', newPassword: '<string>'})
};
fetch('https://api.sublay.io/v8/:projectId/auth/reset-password', options)
.then(res => res.json())
.then(res => console.log(res))
.catch(err => console.error(err));<?php
$curl = curl_init();
curl_setopt_array($curl, [
CURLOPT_URL => "https://api.sublay.io/v8/:projectId/auth/reset-password",
CURLOPT_RETURNTRANSFER => true,
CURLOPT_ENCODING => "",
CURLOPT_MAXREDIRS => 10,
CURLOPT_TIMEOUT => 30,
CURLOPT_HTTP_VERSION => CURL_HTTP_VERSION_1_1,
CURLOPT_CUSTOMREQUEST => "POST",
CURLOPT_POSTFIELDS => json_encode([
'token' => '<string>',
'newPassword' => '<string>'
]),
CURLOPT_HTTPHEADER => [
"Authorization: Bearer <token>",
"Content-Type: application/json"
],
]);
$response = curl_exec($curl);
$err = curl_error($curl);
curl_close($curl);
if ($err) {
echo "cURL Error #:" . $err;
} else {
echo $response;
}package main
import (
"fmt"
"strings"
"net/http"
"io"
)
func main() {
url := "https://api.sublay.io/v8/:projectId/auth/reset-password"
payload := strings.NewReader("{\n \"token\": \"<string>\",\n \"newPassword\": \"<string>\"\n}")
req, _ := http.NewRequest("POST", url, payload)
req.Header.Add("Authorization", "Bearer <token>")
req.Header.Add("Content-Type", "application/json")
res, _ := http.DefaultClient.Do(req)
defer res.Body.Close()
body, _ := io.ReadAll(res.Body)
fmt.Println(string(body))
}HttpResponse<String> response = Unirest.post("https://api.sublay.io/v8/:projectId/auth/reset-password")
.header("Authorization", "Bearer <token>")
.header("Content-Type", "application/json")
.body("{\n \"token\": \"<string>\",\n \"newPassword\": \"<string>\"\n}")
.asString();require 'uri'
require 'net/http'
url = URI("https://api.sublay.io/v8/:projectId/auth/reset-password")
http = Net::HTTP.new(url.host, url.port)
http.use_ssl = true
request = Net::HTTP::Post.new(url)
request["Authorization"] = 'Bearer <token>'
request["Content-Type"] = 'application/json'
request.body = "{\n \"token\": \"<string>\",\n \"newPassword\": \"<string>\"\n}"
response = http.request(request)
puts response.read_body{
"success": true,
"message": "<string>"
}Auth Endpoints
Reset Password
Reset a user’s password using a token from the reset email
Reset Password
curl --request POST \
--url https://api.sublay.io/v8/:projectId/auth/reset-password \
--header 'Authorization: Bearer <token>' \
--header 'Content-Type: application/json' \
--data '
{
"token": "<string>",
"newPassword": "<string>"
}
'import requests
url = "https://api.sublay.io/v8/:projectId/auth/reset-password"
payload = {
"token": "<string>",
"newPassword": "<string>"
}
headers = {
"Authorization": "Bearer <token>",
"Content-Type": "application/json"
}
response = requests.post(url, json=payload, headers=headers)
print(response.text)const options = {
method: 'POST',
headers: {Authorization: 'Bearer <token>', 'Content-Type': 'application/json'},
body: JSON.stringify({token: '<string>', newPassword: '<string>'})
};
fetch('https://api.sublay.io/v8/:projectId/auth/reset-password', options)
.then(res => res.json())
.then(res => console.log(res))
.catch(err => console.error(err));<?php
$curl = curl_init();
curl_setopt_array($curl, [
CURLOPT_URL => "https://api.sublay.io/v8/:projectId/auth/reset-password",
CURLOPT_RETURNTRANSFER => true,
CURLOPT_ENCODING => "",
CURLOPT_MAXREDIRS => 10,
CURLOPT_TIMEOUT => 30,
CURLOPT_HTTP_VERSION => CURL_HTTP_VERSION_1_1,
CURLOPT_CUSTOMREQUEST => "POST",
CURLOPT_POSTFIELDS => json_encode([
'token' => '<string>',
'newPassword' => '<string>'
]),
CURLOPT_HTTPHEADER => [
"Authorization: Bearer <token>",
"Content-Type: application/json"
],
]);
$response = curl_exec($curl);
$err = curl_error($curl);
curl_close($curl);
if ($err) {
echo "cURL Error #:" . $err;
} else {
echo $response;
}package main
import (
"fmt"
"strings"
"net/http"
"io"
)
func main() {
url := "https://api.sublay.io/v8/:projectId/auth/reset-password"
payload := strings.NewReader("{\n \"token\": \"<string>\",\n \"newPassword\": \"<string>\"\n}")
req, _ := http.NewRequest("POST", url, payload)
req.Header.Add("Authorization", "Bearer <token>")
req.Header.Add("Content-Type", "application/json")
res, _ := http.DefaultClient.Do(req)
defer res.Body.Close()
body, _ := io.ReadAll(res.Body)
fmt.Println(string(body))
}HttpResponse<String> response = Unirest.post("https://api.sublay.io/v8/:projectId/auth/reset-password")
.header("Authorization", "Bearer <token>")
.header("Content-Type", "application/json")
.body("{\n \"token\": \"<string>\",\n \"newPassword\": \"<string>\"\n}")
.asString();require 'uri'
require 'net/http'
url = URI("https://api.sublay.io/v8/:projectId/auth/reset-password")
http = Net::HTTP.new(url.host, url.port)
http.use_ssl = true
request = Net::HTTP::Post.new(url)
request["Authorization"] = 'Bearer <token>'
request["Content-Type"] = 'application/json'
request.body = "{\n \"token\": \"<string>\",\n \"newPassword\": \"<string>\"\n}"
response = http.request(request)
puts response.read_body{
"success": true,
"message": "<string>"
}Sets a new password for a user by validating a reset token received via email.
On success, in one transaction, the server writes the new password, invalidates every refresh token for that user — including the session that asked for the reset — and deletes every push binding that user holds on every device, so notification content stops routing to a device someone else may hold. Either all three land or none does. Projects without the
Returned when the token does not match any user record or the token has
expired (1 hour TTL).
Nothing was committed — the password, the sessions and the push bindings are
all as they were, and the reset token is still usable.
Rate limit: 5 requests per 15 minutes per IP. Exceeding it returns
push bundle skip the binding step and are otherwise unaffected. The user’s own devices re-bind on their own the next time each is opened.
Access tokens are not revoked by this: one minted before the reset keeps working until it expires, up to 30 minutes. It is the refresh families that go, so no device can mint a new one.
Body Parameters
string
required
The raw reset token from the password reset email link. The server hashes
this token internally before comparing it to the stored hash.
string
required
The new password to set.
Response
boolean
true on success.string
Confirmation message:
"Password has been reset successfully."Error Responses
Invalid or Expired Token — 400
Invalid or Expired Token — 400
{
"error": "Invalid or expired password reset token.",
"code": "auth/invalid-reset-token"
}
Server Error — 500
Server Error — 500
{
"error": "Internal server error.",
"code": "auth/server-error"
}
Every session for the user is revoked and every push binding they hold is
removed, on every device. The user signs in again everywhere, and each device
re-binds for push on its own once it is next opened.
429 with the plain-text message Too many password reset attempts, please wait 15 minutes and no code.

