POST
Finish a password reset
Send the email, the reset code from the email, and the new password. The response is always a SECURITY_SETUP_REQUIRED challenge with a session_token — never tokens directly. The user must set up a second factor before any tokens are issued.
The user must set up a passkey (recommended) or 2FA before any tokens are issued. Carry the session_token through Complete security setup to finish and get tokens.

Headers

x-program-id
string
required

Identifies the program. Can also be sent as the programId query parameter.

Body

application/json
email
string<email>
required
code
string
required

Reset code from the email.

new_password
string
required
Minimum string length: 8

Response

Tokens, or the next challenge

success
boolean
Example:

true

data
object

Returned when login is fully complete.