Change your password

POST

/api/auth/change-password

curl --request POST \
  --url http://localhost:3000/api/auth/change-password \
  --header 'Content-Type: application/json' \
  --cookie merran.session_token=<merran.session_token> \
  --data '{ "currentPassword": "correct horse battery staple", "newPassword": "a longer, newer passphrase", "revokeOtherSessions": true }'

• Your Merran

Needs your current password. The new one needs at least 10 characters. With revokeOtherSessions, everywhere else is signed out too, and a new token comes back for this session.

Authorizations

• session

Request Body^required

Media typeapplication/json

object

newPassword

required

The new password to set

string

currentPassword

required

The current password is required

string

revokeOtherSessions

Must be a boolean value

boolean

Example

{
  "currentPassword": "correct horse battery staple",
  "newPassword": "a longer, newer passphrase",
  "revokeOtherSessions": true
}

Responses

200

Password successfully changed

Media typeapplication/json

object

token

New session token if other sessions were revoked

string

nullable

user

required

object

id

required

The unique identifier of the user

string

email

required

The email address of the user

string format: email

name

required

The name of the user

string

image

The profile image URL of the user

string format: uri

nullable

emailVerified

required

Whether the email has been verified

boolean

createdAt

required

When the user was created

string format: date-time

updatedAt

required

When the user was last updated

string format: date-time

Example

{
  "token": "sample-session-token",
  "user": {
    "id": "0199e8b0-5a10-7a01-8b00-000000000001",
    "name": "Sam Rivera",
    "email": "sam@example.com",
    "emailVerified": false,
    "image": null,
    "createdAt": "2026-10-01T17:30:00.000Z",
    "updatedAt": "2026-10-01T17:30:00.000Z",
    "username": "sam",
    "displayUsername": "sam",
    "role": "admin",
    "banned": false
  }
}

400

Bad Request. Usually due to missing parameters, or invalid parameters.

Media typeapplication/json

object

message

required

string

Example ^generated

{
  "message": "example"
}

401

Unauthorized. Due to missing or invalid authentication.

Media typeapplication/json

object

message

required

string

Example ^generated

{
  "message": "example"
}

403

Forbidden. You do not have permission to access this resource or to perform this action.

Media typeapplication/json

object

message

string

Example ^generated

{
  "message": "example"
}

404

Not Found. The requested resource was not found.

Media typeapplication/json

object

message

string

Example ^generated

{
  "message": "example"
}

429

Too Many Requests. You have exceeded the rate limit. Try again later.

Media typeapplication/json

object

message

string

Example ^generated

{
  "message": "example"
}

500

Internal Server Error. This is a problem with the server that you cannot fix.

Media typeapplication/json

object

message

string

Example ^generated

{
  "message": "example"
}