Complete a password reset using a token
const url = 'https://api.aetherpush.com/v1/auth/reset-password';const options = { method: 'POST', headers: {'Content-Type': 'application/json'}, body: '{"token":"AbCdEf1234567890XyZ","password":"a-new-strong-password-99"}'};
try { const response = await fetch(url, options); const data = await response.json(); console.log(data);} catch (error) { console.error(error);}curl --request POST \ --url https://api.aetherpush.com/v1/auth/reset-password \ --header 'Content-Type: application/json' \ --data '{ "token": "AbCdEf1234567890XyZ", "password": "a-new-strong-password-99" }'Resets the account password using a token received via the
password-reset email. The password change and the teardown of every
session and CLI login commit in one transaction. The second factor is
deliberately left untouched, so a stolen mailbox stops at the MFA
challenge; mfa_setup_deadline is not cleared either.
Request Bodyrequired
Section titled “Request Bodyrequired”object
Token received via the password-reset email link.
Example
{ "token": "AbCdEf1234567890XyZ", "password": "a-new-strong-password-99"}Responses
Section titled “Responses”Password reset successful. Sessions and CLI logins signed out.
object
Always false. The reset signs out sessions and CLI logins but never removes a second factor: a stolen mailbox stops at the MFA challenge. Evicting a factor is a separate, step-up-gated action from an authenticated session. The field is kept so an older dashboard can localize from what the server did.
Example
{ "message": "Password reset successfully. All sessions and CLI logins have been signed out. Your other sign-in methods were not changed. Please log in again.", "evicted": false}Token or password missing, weak password, or invalid/expired token.
Standard error envelope. code is the stable machine identifier for
client branching and i18n. The wording of error is a human-readable
fallback and is not part of the contract. Specialized responses keep
narrower code enums where clients already branch on them.
object
Human-readable error message.
Stable machine code. Prefer this over matching on error. The
values this API can answer with are listed in the ApiErrorCode
schema of the raw document at
https://api.aetherpush.com/openapi.yaml. The field stays an
open string here so that a release adding a value does not
invalidate this response.
Unique identifier for the request, also exposed as the X-Request-Id response header.
object
object
Stable machine code for this field error.
Examples
Missing token or password
{ "error": "Token and new password are required.", "code": "token_and_password_required", "requestId": "req_abc123"}Token missing or expired
{ "error": "Invalid or expired reset token.", "code": "reset_token_invalid", "requestId": "req_abc123"}Token already used
{ "error": "This reset token has already been used.", "code": "reset_token_used", "requestId": "req_abc123"}Weak password failing strength rules
{ "error": "Validation failed.", "code": "validation_failed", "errors": [ { "field": "password", "message": "Password must be at least 12 characters long.", "code": "password_too_short" } ], "requestId": "req_abc123"}Too many password reset attempts from this IP.
Standard error envelope. code is the stable machine identifier for
client branching and i18n. The wording of error is a human-readable
fallback and is not part of the contract. Specialized responses keep
narrower code enums where clients already branch on them.
object
Human-readable error message.
Stable machine code. Prefer this over matching on error. The
values this API can answer with are listed in the ApiErrorCode
schema of the raw document at
https://api.aetherpush.com/openapi.yaml. The field stays an
open string here so that a release adding a value does not
invalidate this response.
Unique identifier for the request, also exposed as the X-Request-Id response header.
Example
{ "error": "The requested resource was not found.", "code": "not_found", "requestId": "req_abc123"}Internal server error.
Standard error envelope. code is the stable machine identifier for
client branching and i18n. The wording of error is a human-readable
fallback and is not part of the contract. Specialized responses keep
narrower code enums where clients already branch on them.
object
Human-readable error message.
Stable machine code. Prefer this over matching on error. The
values this API can answer with are listed in the ApiErrorCode
schema of the raw document at
https://api.aetherpush.com/openapi.yaml. The field stays an
open string here so that a release adding a value does not
invalidate this response.
Unique identifier for the request, also exposed as the X-Request-Id response header.
Example
{ "error": "The requested resource was not found.", "code": "not_found", "requestId": "req_abc123"}