Finalizes the password reset process. Takes in the new password and confirmation. Verifies the token is valid and unexpired before updating the password.
This endpoint finalizes the password reset process. It takes in the new password and confirmation of that password from the user, verifies the token is valid, and then encrypts and stores the new password in the database.
The token must be valid, unused, and unexpired. Password reset tokens expire after 14 days. If a token has expired, the endpoint returns a 404 status with an ["expired"] response body and the password is not changed. If a token has already been used, the endpoint returns a 404 status with an ["already used"] response body.
An expired token is not consumed — the user must request a new reset link via the Initiate Password Reset endpoint.
Response Structure
| Code | Response | Reason |
|---|---|---|
| 200 | Success | The password was successfully reset. |
| 404 | ["expired"] | The token has exceeded the 14-day expiry window. |
| 404 | ["already used"] | The token has already been used to reset a password. |
| 404 | Not Found | The token does not exist. |