POST
/
api
/
v1
/
auth
/
reset-password
Reset password
curl --request POST \
  --url https://api.example.com/api/v1/auth/reset-password
import requests

url = "https://api.example.com/api/v1/auth/reset-password"

response = requests.post(url)

print(response.text)
const options = {method: 'POST'};

fetch('https://api.example.com/api/v1/auth/reset-password', options)
.then(res => res.json())
.then(res => console.log(res))
.catch(err => console.error(err));
<?php

$curl = curl_init();

curl_setopt_array($curl, [
CURLOPT_URL => "https://api.example.com/api/v1/auth/reset-password",
CURLOPT_RETURNTRANSFER => true,
CURLOPT_ENCODING => "",
CURLOPT_MAXREDIRS => 10,
CURLOPT_TIMEOUT => 30,
CURLOPT_HTTP_VERSION => CURL_HTTP_VERSION_1_1,
CURLOPT_CUSTOMREQUEST => "POST",
]);

$response = curl_exec($curl);
$err = curl_error($curl);

curl_close($curl);

if ($err) {
echo "cURL Error #:" . $err;
} else {
echo $response;
}
package main

import (
"fmt"
"net/http"
"io"
)

func main() {

url := "https://api.example.com/api/v1/auth/reset-password"

req, _ := http.NewRequest("POST", url, nil)

res, _ := http.DefaultClient.Do(req)

defer res.Body.Close()
body, _ := io.ReadAll(res.Body)

fmt.Println(string(body))

}
HttpResponse<String> response = Unirest.post("https://api.example.com/api/v1/auth/reset-password")
.asString();
require 'uri'
require 'net/http'

url = URI("https://api.example.com/api/v1/auth/reset-password")

http = Net::HTTP.new(url.host, url.port)
http.use_ssl = true

request = Net::HTTP::Post.new(url)

response = http.request(request)
puts response.read_body

Overview

Confirms a password reset by submitting the 6-digit code received via POST /forgot-password along with the new password. On success:
  1. The OTP row is marked consumed.
  2. The new password is hashed with argon2id and persisted.
  3. All active refresh tokens for the user are revoked — every device gets logged out. This is intentional: if the reset request was attacker-driven, the legitimate user still controls their email, but we cannot trust any session that might predate the request.
The client must then call POST /login with the new password to start a fresh session. Same 5-attempt cap and INVALID_CODE / CODE_EXPIRED semantics as /verify-email.

Authentication

None required.

Path parameters

None.

Query parameters

None.

Request body

FieldTypeRequiredAllowed valuesExample
emailstringyesRFC 5322 valid, lowercased server-sidealice@example.com
codestringyesExactly 6 digits729048
newPasswordstringyes8..200 chars; must contain at least one letter AND one digitn3wsecret9

Example payload

{
  "email": "alice@example.com",
  "code": "729048",
  "newPassword": "n3wsecret9"
}

Response — 200 OK

FieldTypeNotesExample
okbooleanAlways true on success. Client should now call /auth/login with the new password.true

Example response

{
  "ok": true
}

Error responses

StatusCodeMeaning
400VALIDATION_FAILEDEmail malformed, code not 6 digits, or new password fails the policy.
401INVALID_CODEWrong digits; attemptsUsed bumped. After 5 tries the row dies.
401CODE_EXPIREDNo live reset OTP — either it expired (15-min TTL), was already consumed, or the attempt cap was hit. Restart from /forgot-password.

Example error — 401 INVALID_CODE

{
  "type": "https://api.swappr.co.uk/errors/invalid-code",
  "title": "Verification code incorrect",
  "status": 401,
  "code": "INVALID_CODE",
  "detail": "Reset code is incorrect",
  "instance": "/api/v1/auth/reset-password",
  "requestId": "01HZQ7K3M4N5P6Q7R8S9T0V1W2"
}

Side effects

  • Consumes the otp_codes row.
  • Updates users.passwordHash to the new argon2id hash.
  • Updates all matching refresh_tokens rows to revokedAt = now — every active session is killed.

See also

curl

curl -X POST https://api.swappr.co.uk/api/v1/auth/reset-password \
  -H "Content-Type: application/json" \
  -d '{
    "email": "alice@example.com",
    "code": "729048",
    "newPassword": "n3wsecret9"
  }'