> ## Documentation Index
> Fetch the complete documentation index at: https://codebyahmed.mintlify.site/llms.txt
> Use this file to discover all available pages before exploring further.

# Change Your Account Password with Session Revocation

> Change your password by providing your current password and a new one meeting complexity requirements. All other sessions are revoked on success.

Keep your account secure by rotating your password regularly. The `PATCH /users/me/password` endpoint verifies your identity with your current password before accepting the change, enforces the platform's complexity policy on the new password, and automatically revokes every other active session so you remain the sole authenticated party.

## Change Password

Supply your current password and a new password in the request body. The new password must differ from your current one and must satisfy all complexity requirements listed below.

**`PATCH /users/me/password`**

<Note>
  Before sending this request, call `GET /auth/csrf-token` to obtain a CSRF token and include it in the `x-csrf-token` header.
</Note>

### Request Body

<ParamField body="current_password" type="string" required>
  Your existing account password. The request is rejected with `401` if this value does not match what is stored on the account.
</ParamField>

<ParamField body="new_password" type="string" required>
  The replacement password. Must be **at least 8 characters** and include all of the following:

  * One uppercase letter (A–Z)
  * One lowercase letter (a–z)
  * One digit (0–9)
  * One special character (e.g. `!`, `@`, `#`, `$`, `%`)

  Must differ from `current_password`. Pattern: `/(?=.*[a-z])(?=.*[A-Z])(?=.*\d)(?=.*[\W_]).{8,}/`
</ParamField>

<CodeGroup>
  ```bash cURL theme={null}
  # Step 1 — get CSRF token
  CSRF=$(curl -s -X GET https://api.example.com/api/v1/auth/csrf-token \
    --cookie "session=<your-session-cookie>" | jq -r '.data.csrf_token')

  # Step 2 — change password
  curl -X PATCH https://api.example.com/api/v1/users/me/password \
    --cookie "session=<your-session-cookie>" \
    -H "x-csrf-token: $CSRF" \
    -H "Content-Type: application/json" \
    -d '{
      "current_password": "Old!Pass1",
      "new_password": "N3w!Secure1"
    }'
  ```

  ```javascript JavaScript theme={null}
  // Step 1 — get CSRF token
  const { data: csrfData } = await fetch(
    "https://api.example.com/api/v1/auth/csrf-token",
    { credentials: "include" }
  ).then((r) => r.json());

  // Step 2 — change password
  const response = await fetch(
    "https://api.example.com/api/v1/users/me/password",
    {
      method: "PATCH",
      credentials: "include",
      headers: {
        "Content-Type": "application/json",
        "x-csrf-token": csrfData.csrf_token,
      },
      body: JSON.stringify({
        current_password: "Old!Pass1",
        new_password: "N3w!Secure1",
      }),
    }
  );
  const result = await response.json();
  ```

  ```python Python theme={null}
  import requests

  session = requests.Session()
  session.cookies.set("session", "<your-session-cookie>")

  # Step 1 — get CSRF token
  csrf = session.get(
      "https://api.example.com/api/v1/auth/csrf-token"
  ).json()["data"]["csrf_token"]

  # Step 2 — change password
  resp = session.patch(
      "https://api.example.com/api/v1/users/me/password",
      headers={"x-csrf-token": csrf},
      json={
          "current_password": "Old!Pass1",
          "new_password": "N3w!Secure1",
      },
  )
  print(resp.json())
  ```
</CodeGroup>

### Response — 200 OK

```json theme={null}
{
  "success": true,
  "data": {}
}
```

<Tip>
  After a successful password change, **all sessions except your current one are immediately revoked**. Users on other devices will need to log in again. If you want to sign out of the current device as well, call `DELETE /auth/session` immediately after this request.
</Tip>

### Error Responses

<Accordion title="400 — Validation Error">
  Returned when:

  * `current_password` or `new_password` is missing from the body.
  * `new_password` does not meet the complexity requirements.
  * `new_password` is identical to `current_password`.

  ```json theme={null}
  {
    "success": false,
    "message": "Validation failed",
    "errors": [
      {
        "field": "new_password",
        "message": "Password must contain an uppercase letter, a lowercase letter, a number, and a special character"
      }
    ],
    "requestId": "req_01H"
  }
  ```
</Accordion>

<Accordion title="401 — Wrong Current Password">
  Returned when `current_password` does not match the stored credential, or when the session cookie is missing or expired.

  ```json theme={null}
  {
    "success": false,
    "message": "Authentication required",
    "requestId": "req_01H"
  }
  ```
</Accordion>

<Accordion title="429 — Rate Limited">
  Password change attempts are rate-limited. Check the `Retry-After` response header for the number of seconds to wait before retrying.

  ```json theme={null}
  {
    "success": false,
    "message": "Too many requests",
    "requestId": "req_01H"
  }
  ```
</Accordion>