Skip to main content

​
POST /api/auth/reset-password/:token

Resets a user’s password using the token received via the forgot password email. All existing refresh tokens are invalidated after a successful password reset.

​
Path parameters

​
token
string
required
Password reset token from the email (32-character hexadecimal string)

​
Request body

​
password
string
required
New password. Must meet the same requirements as registration:
  • Minimum 8 characters
  • At least one uppercase letter
  • At least one lowercase letter
  • At least one digit

​
Response

​
success
boolean
Indicates if the password reset was successful
​
message
string
Human-readable response message

​
Status codes

  • 200 - Password reset successful
  • 400 - Invalid or expired reset token, or missing password
  • 500 - Internal server error
After a successful password reset, the user must log in again with their new password. All existing sessions are invalidated.
Reset tokens expire after 1 hour. Users must complete the reset process before the token expires or request a new reset link.

​
Examples

curl -X POST https://api.campusbite.com/api/auth/reset-password/a3f2e1b9c8d7e6f5a4b3c2d1e0f9a8b7c6d5e4f3a2b1c0d9e8f7a6b5c4d3e2f1 \
  -H "Content-Type: application/json" \
  -d '{
    "password": "NewSecurePass123"
  }'

​
Success response (200)

{
  "success": true,
  "message": "Password reset successful. Please log in with your new password."
}

​
Error response (400) - Invalid token

{
  "success": false,
  "message": "Invalid or expired reset token."
}

​
Error response (400) - Missing fields

{
  "success": false,
  "message": "Token and new password are required."
}

​
Security measures

The password reset process includes several security features:
  1. Token expiration: Reset tokens expire after 1 hour
  2. Single use: Once used, the token is removed from the user record
  3. Session invalidation: All refresh tokens are deleted, forcing re-authentication
  4. Password hashing: New passwords are hashed with bcrypt (12 rounds)
  5. Token cleanup: Both the reset token and expiration date are cleared after use

Build docs developers (and LLMs) love

Get started for freeTalk to us