POST
Change a temporary password

Authorizations

Authorization
string
header
required

The user's id_token from authentication — the ID token, not the access_token. The program and environment come from the token.

Headers

x-program-id
string
required

Identifies the program. Can also be sent as the programId query parameter.

Body

application/json
email
string<email>
required
temporary_password
string
required
new_password
string
required
Minimum string length: 8

Response

The security setup challenge. Changing the temporary password logs the user in but never returns tokens directly — the response is always a SECURITY_SETUP_REQUIRED challenge. Take the session_token into the security setup flow (passkey or 2FA) to get tokens.

success
boolean
Example:

true

data
object