Consume a password-reset token + rotate the password

POST/api/auth/password/reset/confirm

confirmPasswordReset

Anonymous. On success (200), the account's password is rotated, every existing session for the account is deleted (forces re-login everywhere including any post-TOTP path), and a notification email is sent. Returns 410 with `{ error: "invalid_or_expired" }` for any token-side failure; 400 with `{ error: "invalid_input" }` when the new password fails validation (too short or matches the current password).

Authentication is not described for this operation in the spec — that does not mean it is public. Check tokens and scopes.

curl

curl -X POST 'https://neosource.dev/api/auth/password/reset/confirm' \
  -H 'Content-Type: application/json' \
  -d '{"token":"string","new_password":"hunter2-new"}'

fetch

fetch("https://neosource.dev/api/auth/password/reset/confirm", {
  method: "POST",
  headers: {
    "Content-Type": "application/json",
  },
  body: JSON.stringify({"token":"string","new_password":"hunter2-new"}),
});

Request bodyrequired

application/json

PasswordResetConfirmRequest

object

new_passwordrequired: string
New password. Validated against the same minimum-length rule as `POST /api/signup`; rejected with 400 if it Argon2-verifies against the current password (no-op reset).
example"hunter2-new"
tokenrequired: string
Base64url-encoded raw token from the reset link.

additional propertiesnot allowed

Responses

200Password rotated

application/json

PasswordResetConfirmResponse

object

okrequired: boolean

Standard errors

Bodies documented once for the whole API — see standard errors.

400Bad Request — one of: invalid_input
410Gone — one of: invalid_or_expired
429Rate limited — retry after the `Retry-After` header
500Internal server error
503Service temporarily unavailable / at capacity — retry after the `Retry-After` header
504Gateway timeout — the request exceeded the server's handling budget