> ## Documentation Index
> Fetch the complete documentation index at: https://docs.sublay.io/llms.txt
> Use this file to discover all available pages before exploring further.

# Reset Password

> Reset a user's password using a token from the reset email

Sets a new password for a user by validating a reset token received via email.

On success, in one transaction, the server writes the new password, invalidates **every refresh token** for that user — including the session that asked for the reset — and deletes **every push binding** that user holds on every device, so notification content stops routing to a device someone else may hold. Either all three land or none does. Projects without the `push` bundle skip the binding step and are otherwise unaffected. The user's own devices re-bind on their own the next time each is opened.

Access tokens are not revoked by this: one minted before the reset keeps working until it expires, up to 30 minutes. It is the refresh families that go, so no device can mint a new one.

## Body Parameters

<ParamField body="token" type="string" required>
  The raw reset token from the password reset email link. The server hashes
  this token internally before comparing it to the stored hash.
</ParamField>

<ParamField body="newPassword" type="string" required>
  The new password to set.
</ParamField>

## Response

<ResponseField name="success" type="boolean">
  `true` on success.
</ResponseField>

<ResponseField name="message" type="string">
  Confirmation message: `"Password has been reset successfully."`
</ResponseField>

## Error Responses

<AccordionGroup>
  <Accordion title="Invalid or Expired Token — 400">
    ```json theme={null}
    {
      "error": "Invalid or expired password reset token.",
      "code": "auth/invalid-reset-token"
    }
    ```

    Returned when the token does not match any user record or the token has
    expired (1 hour TTL).
  </Accordion>

  <Accordion title="Server Error — 500">
    ```json theme={null}
    {
      "error": "Internal server error.",
      "code": "auth/server-error"
    }
    ```

    Nothing was committed — the password, the sessions and the push bindings are
    all as they were, and the reset token is still usable.
  </Accordion>
</AccordionGroup>

<Warning>
  Every session for the user is revoked and every push binding they hold is
  removed, on every device. The user signs in again everywhere, and each device
  re-binds for push on its own once it is next opened.
</Warning>

**Rate limit:** 5 requests per 15 minutes per IP. Exceeding it returns `429` with the plain-text message `Too many password reset attempts, please wait 15 minutes` and no `code`.

## See Also

* [Request Password Reset endpoint](/v8/api-reference/auth/request-password-reset)
* [`useRequestPasswordReset` hook](/v8/hooks/auth/use-request-password-reset)
* [Built-in Auth guide](/v8/sdk/authentication/built-in)


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.