Complete a password reset using a token
const url = 'https://api.aetherpush.com/v1/auth/reset-password';const options = { method: 'POST', headers: {'Content-Type': 'application/json'}, body: '{"token":"AbCdEf1234567890XyZ","password":"a-new-strong-password-99"}'};
try { const response = await fetch(url, options); const data = await response.json(); console.log(data);} catch (error) { console.error(error);}curl --request POST \ --url https://api.aetherpush.com/v1/auth/reset-password \ --header 'Content-Type: application/json' \ --data '{ "token": "AbCdEf1234567890XyZ", "password": "a-new-strong-password-99" }'Resets the account password using a token received via the
password-reset email. The password change and the teardown of every
session and CLI login commit in one transaction. The second factor is
deliberately left untouched, so a stolen mailbox stops at the MFA
challenge; mfa_setup_deadline is not cleared either.
Request Bodyrequired
Section titled “Request Bodyrequired”object
Token received via the password-reset email link.
Example
{ "token": "AbCdEf1234567890XyZ", "password": "a-new-strong-password-99"}Responses
Section titled “Responses”Password reset successful. Sessions and CLI logins signed out.
object
Always false. The reset signs out sessions and CLI logins but never removes a second factor: a stolen mailbox stops at the MFA challenge. Evicting a factor is a separate, step-up-gated action from an authenticated session. The field is kept so an older dashboard can localize from what the server did.
Example
{ "message": "Password reset successfully. All sessions and CLI logins have been signed out. Your other sign-in methods were not changed. Please log in again.", "evicted": false}Token or password missing, weak password, or invalid/expired token.
object
Human-readable error message.
Unique identifier for the request, also exposed as the X-Request-Id response header.
Returned by registration and password-reset endpoints when the submitted password fails strength validation. Distinct from the generic Error envelope so the dashboard can render per-rule feedback inline.
object
object
Examples
Missing token or password
{ "error": "Token and new password are required.", "requestId": "req_abc123"}Token already used or expired
{ "error": "Invalid or expired reset token.", "requestId": "req_abc123"}Weak password failing strength rules
{ "errors": [ { "field": "password", "message": "Password must be at least 12 characters long." } ]}Too many password reset attempts from this IP.
object
Human-readable error message.
Unique identifier for the request, also exposed as the X-Request-Id response header.
Example
{ "error": "The requested resource was not found.", "requestId": "req_abc123"}Internal server error.
object
Human-readable error message.
Unique identifier for the request, also exposed as the X-Request-Id response header.
Example
{ "error": "The requested resource was not found.", "requestId": "req_abc123"}