Change Password

Change the password (argon2id). Every access token issued before stops at once (the current session gets a new one from `/auth/refresh`). By default every other session and connected app (OAuth) is signed out; the current one (its refresh cookie) stays. A wrong current password is a 400 and counts against the login rate limit (429 with `Retry-After` past it).

API key access

Not available to API keys or connected apps: only a signed-in person can call this route.

POST/api/v1/auth/password

Authorization

AuthorizationBearer <token>

Access token from /api/v1/auth/login, or an API key (ro_pat_..., RO-176) from /api/v1/workspaces/current/api-keys: the key implies its workspace and needs the route's scope. MCP connectors (/api/v1/mcp only) may use an OAuth access token (ro_oat_..., RO-284).

In: header

Request Body

current_passwordstring

Length1 <= length <= 256

new_passwordstring

8 to 256 characters, not blank, different from the current one.

Lengthlength <= 256

sign_out_other_sessions?boolean

Sign out every other session (this one stays signed in).

Defaulttrue

Response Body

curl -X POST "http://localhost:8000/api/v1/auth/password" \
  -H "Content-Type: application/json" \
  -d '{
    "current_password": "string",
    "new_password": "string"
  }'

curl -X POST "http://localhost:8000/api/v1/auth/password" \  -H "Content-Type: application/json" \  -d '{    "current_password": "string",    "new_password": "string"  }'

{
  "sessions_revoked": 0
}

Empty

{
  "detail": [
    {
      "loc": [
        "string"
      ],
      "msg": "string",
      "type": "string",
      "input": null,
      "ctx": {}
    }
  ]
}

Empty

Authorization

Request Body

Response Body

200

400

403

422

429