POST
Change a temporary password
When an admin resets a user, the user gets a temporary password and a NEW_PASSWORD_REQUIRED challenge at login. Use this endpoint to replace it with a real password. Send the email, the temporary password, and the new password. The response is always a SECURITY_SETUP_REQUIRED challenge with a session_token — never tokens directly. The user must set up a second factor before any tokens are issued.
The user must set up a passkey (recommended) or 2FA before any tokens are issued. Carry the session_token through Complete security setup to finish and get tokens.
The new password must meet the password policy. If it doesn’t, you’ll get a 400 with code INVALID_PASSWORD.
If the user already completed this change and submits it again, login succeeds outright with no NEW_PASSWORD_REQUIRED challenge and you’ll get a 409 with code USER_ALREADY_CONFIRMED. The password is already set — send the user to Log in with their new password.

Authorizations

Authorization
string
header
required

The user's id_token from authentication — the ID token, not the access_token. The program and environment come from the token.

Headers

x-program-id
string
required

Identifies the program. Can also be sent as the programId query parameter.

Body

application/json
email
string<email>
required
temporary_password
string
required
new_password
string
required
Minimum string length: 8

Response

The security setup challenge. Changing the temporary password logs the user in but never returns tokens directly — the response is always a SECURITY_SETUP_REQUIRED challenge. Take the session_token into the security setup flow (passkey or 2FA) to get tokens.

success
boolean
Example:

true

data
object