Skip to main content
POST
Reset a password with a token
Consumes a valid (unused, unexpired) reset token, sets the new password, and revokes all of that user’s sessions — forcing re-login everywhere. Invalid, expired, or already-used tokens return a generic 400 so the endpoint is not a token oracle. This is also the endpoint behind the invite-acceptance page: teammates added via POST /v1/users/invite set their first password here with the token from the invitation email.

Body Parameters

Example Request

Example Response

Authorizations

Authorization
string
header
required

Body

application/json
token
string
required
password
string<password>
required
Minimum string length: 8

Response

Password reset; all sessions revoked.

message
string