Change Your Account Password with Session Revocation

Keep your account secure by rotating your password regularly. The PATCH /users/me/password endpoint verifies your identity with your current password before accepting the change, enforces the platform’s complexity policy on the new password, and automatically revokes every other active session so you remain the sole authenticated party.

Change Password

Supply your current password and a new password in the request body. The new password must differ from your current one and must satisfy all complexity requirements listed below. PATCH /users/me/password

Before sending this request, call GET /auth/csrf-token to obtain a CSRF token and include it in the x-csrf-token header.

Request Body

string

required

Your existing account password. The request is rejected with 401 if this value does not match what is stored on the account.

string

required

The replacement password. Must be at least 8 characters and include all of the following:

One uppercase letter (A–Z)
One lowercase letter (a–z)
One digit (0–9)
One special character (e.g. !, @, #, $, %)

Must differ from current_password. Pattern: /(?=.*[a-z])(?=.*[A-Z])(?=.*\d)(?=.*[\W_]).{8,}/

# Step 1 — get CSRF token
CSRF=$(curl -s -X GET https://api.example.com/api/v1/auth/csrf-token \
  --cookie "session=<your-session-cookie>" | jq -r '.data.csrf_token')

# Step 2 — change password
curl -X PATCH https://api.example.com/api/v1/users/me/password \
  --cookie "session=<your-session-cookie>" \
  -H "x-csrf-token: $CSRF" \
  -H "Content-Type: application/json" \
  -d '{
    "current_password": "Old!Pass1",
    "new_password": "N3w!Secure1"
  }'

// Step 1 — get CSRF token
const { data: csrfData } = await fetch(
  "https://api.example.com/api/v1/auth/csrf-token",
  { credentials: "include" }
).then((r) => r.json());

// Step 2 — change password
const response = await fetch(
  "https://api.example.com/api/v1/users/me/password",
  {
    method: "PATCH",
    credentials: "include",
    headers: {
      "Content-Type": "application/json",
      "x-csrf-token": csrfData.csrf_token,
    },
    body: JSON.stringify({
      current_password: "Old!Pass1",
      new_password: "N3w!Secure1",
    }),
  }
);
const result = await response.json();

import requests

session = requests.Session()
session.cookies.set("session", "<your-session-cookie>")

# Step 1 — get CSRF token
csrf = session.get(
    "https://api.example.com/api/v1/auth/csrf-token"
).json()["data"]["csrf_token"]

# Step 2 — change password
resp = session.patch(
    "https://api.example.com/api/v1/users/me/password",
    headers={"x-csrf-token": csrf},
    json={
        "current_password": "Old!Pass1",
        "new_password": "N3w!Secure1",
    },
)
print(resp.json())

Response — 200 OK

{
  "success": true,
  "data": {}
}

After a successful password change, all sessions except your current one are immediately revoked. Users on other devices will need to log in again. If you want to sign out of the current device as well, call DELETE /auth/session immediately after this request.

Error Responses

400 — Validation Error

Returned when:

current_password or new_password is missing from the body.
new_password does not meet the complexity requirements.
new_password is identical to current_password.

{
  "success": false,
  "message": "Validation failed",
  "errors": [
    {
      "field": "new_password",
      "message": "Password must contain an uppercase letter, a lowercase letter, a number, and a special character"
    }
  ],
  "requestId": "req_01H"
}

401 — Wrong Current Password

Returned when current_password does not match the stored credential, or when the session cookie is missing or expired.

{
  "success": false,
  "message": "Authentication required",
  "requestId": "req_01H"
}

429 — Rate Limited

Password change attempts are rate-limited. Check the Retry-After response header for the number of seconds to wait before retrying.

{
  "success": false,
  "message": "Too many requests",
  "requestId": "req_01H"
}

Auth & Sessions

Account

Catalog

Cart & Checkout

Reviews

Change Your Account Password with Session Revocation

Change Password

Request Body

Response — 200 OK

Error Responses

​Change Password

​Request Body

​Response — 200 OK

​Error Responses

Change Password

Request Body

Response — 200 OK

Error Responses