Reset a password

Set a new password for an identity using a password reset token, e.g. on your app's "reset password" page. This can be called from a browser.

The API token needs the authenticate permission for the identity's group. The reset token can only be used once. When the password is reset:

the identity is logged out everywhere,
its email address is marked as verified (the reset link reached it), and
its failed login attempts are cleared.

The identity isn't logged in afterwards: ask it to log in with its new password.

POST https://api.jsonpad.io/identities/password-reset/confirm

Example

1234567

curl https://api.jsonpad.io/identities/password-reset/confirm \
  -H "Content-Type: application/json" \
  -H "x-api-token: <YOUR TOKEN>" \
  -d '{
        "resetToken": "<RESET TOKEN>",
        "password": "new-correct-horse"
      }'

Parameters

No parameters

Request headers

required
x-api-tokenstringYour API token.

Request body

{resetToken: "<RESET TOKEN>"
password: "new-correct-horse"
}

required
resetTokenstringThe token from requesting a password reset.
required
passwordstringThe new password. It must be at least 8 characters, and at most 72 bytes, long.

Response body

200 OK

The identity.

{id: "f9660578-f8e0-490e-91be-8040fbb09684"
createdAt: "2026-09-18T20:32:09.359Z"
updatedAt: "2026-09-18T20:32:09.359Z"
name: "Sample Identity"
displayName: "Sample Display Name"
email: "identity@example.com"
emailVerified: true
hasPassword: true
tags: [0: "my-app"
]
group: "sample-group"
lastLoginAt: "2026-09-18T20:32:09.359Z"
activated: true
}

400 Bad Request

IDENTITY_RESET_TOKEN_INVALID if the token doesn't exist, has been used, has expired, or was replaced by a newer one.

Response headers

No response headers

2026-09-17