POST /me/password

Change the authenticated user’s password. Clears must_change_password and revokes the caller’s other browser sessions across all replicas.

POST /me/password lets the authenticated user rotate their own password. It is available even while must_change_password is true, so a newly created user can complete first-login by changing the generated password.

Endpoint

POST http://localhost:8080/me/password

Authentication: session cookie or Authorization: Bearer lsk_....

Request body

current_password · string · required

The caller’s current password.

new_password · string · required

The new password. Must contain at least 12 characters.

Example

curl -X POST http://localhost:8080/me/password \
  -H "Authorization: Bearer lsk_xxxxxxxx" \
  -H "Content-Type: application/json" \
  -d '{"current_password": "old-password", "new_password": "new-password-2026"}'

A successful change clears must_change_password and revokes every other session belonging to the caller.