Change Password

POST

auth

password

Change Password

curl --request POST \
  --url https://auth.nullpass.xyz/api/auth/password \
  --header 'Authorization: Bearer <token>' \
  --header 'Content-Type: application/json' \
  --data '
{
  "currentPassword": "<string>",
  "newPassword": "<string>",
  "verificationCode": "<string>"
}
'

import requests

url = "https://auth.nullpass.xyz/api/auth/password"

payload = {
    "currentPassword": "<string>",
    "newPassword": "<string>",
    "verificationCode": "<string>"
}
headers = {
    "Authorization": "Bearer <token>",
    "Content-Type": "application/json"
}

response = requests.post(url, json=payload, headers=headers)

print(response.text)

const options = {
  method: 'POST',
  headers: {Authorization: 'Bearer <token>', 'Content-Type': 'application/json'},
  body: JSON.stringify({
    currentPassword: '<string>',
    newPassword: '<string>',
    verificationCode: '<string>'
  })
};

fetch('https://auth.nullpass.xyz/api/auth/password', options)
  .then(res => res.json())
  .then(res => console.log(res))
  .catch(err => console.error(err));

<?php

$curl = curl_init();

curl_setopt_array($curl, [
  CURLOPT_URL => "https://auth.nullpass.xyz/api/auth/password",
  CURLOPT_RETURNTRANSFER => true,
  CURLOPT_ENCODING => "",
  CURLOPT_MAXREDIRS => 10,
  CURLOPT_TIMEOUT => 30,
  CURLOPT_HTTP_VERSION => CURL_HTTP_VERSION_1_1,
  CURLOPT_CUSTOMREQUEST => "POST",
  CURLOPT_POSTFIELDS => json_encode([
    'currentPassword' => '<string>',
    'newPassword' => '<string>',
    'verificationCode' => '<string>'
  ]),
  CURLOPT_HTTPHEADER => [
    "Authorization: Bearer <token>",
    "Content-Type: application/json"
  ],
]);

$response = curl_exec($curl);
$err = curl_error($curl);

curl_close($curl);

if ($err) {
  echo "cURL Error #:" . $err;
} else {
  echo $response;
}

package main

import (
	"fmt"
	"strings"
	"net/http"
	"io"
)

func main() {

	url := "https://auth.nullpass.xyz/api/auth/password"

	payload := strings.NewReader("{\n  \"currentPassword\": \"<string>\",\n  \"newPassword\": \"<string>\",\n  \"verificationCode\": \"<string>\"\n}")

	req, _ := http.NewRequest("POST", url, payload)

	req.Header.Add("Authorization", "Bearer <token>")
	req.Header.Add("Content-Type", "application/json")

	res, _ := http.DefaultClient.Do(req)

	defer res.Body.Close()
	body, _ := io.ReadAll(res.Body)

	fmt.Println(string(body))

}

HttpResponse<String> response = Unirest.post("https://auth.nullpass.xyz/api/auth/password")
  .header("Authorization", "Bearer <token>")
  .header("Content-Type", "application/json")
  .body("{\n  \"currentPassword\": \"<string>\",\n  \"newPassword\": \"<string>\",\n  \"verificationCode\": \"<string>\"\n}")
  .asString();

require 'uri'
require 'net/http'

url = URI("https://auth.nullpass.xyz/api/auth/password")

http = Net::HTTP.new(url.host, url.port)
http.use_ssl = true

request = Net::HTTP::Post.new(url)
request["Authorization"] = 'Bearer <token>'
request["Content-Type"] = 'application/json'
request.body = "{\n  \"currentPassword\": \"<string>\",\n  \"newPassword\": \"<string>\",\n  \"verificationCode\": \"<string>\"\n}"

response = http.request(request)
puts response.read_body

Endpoint

POST /api/auth/password

Overview

Changes the authenticated user’s password. Requires the current password for verification. Password is hashed with bcrypt before storage.

Request

string

required

Current password for verification

string

required

New password. Minimum 8 characters.

Response

boolean

Always true on success

string

“Password changed successfully”

Implementation Details

Process Flow

Authentication: Verifies user is authenticated
Current Password Check: Compares provided password with stored hash
Password Hashing: Hashes new password with bcrypt (10 rounds)
Update: Updates password hash in database
Audit Logging: Logs PASSWORD_CHANGE event

Code Reference

export async function POST(request: NextRequest) {
  const corsResponse = handleCors(request)
  if (corsResponse) return corsResponse

  const blocked = await protectRoute(request, { requested: 2 })
  if (blocked) return blocked

  const auth = await requireAuth(request)
  if ('error' in auth) return auth.error

  try {
    const body = await request.json()
    const validated = changePasswordSchema.parse(body)

    const user = await prisma.user.findUnique({
      where: { id: auth.userId },
      select: {
        id: true,
        passwordHash: true,
      },
    })

    if (!user || !user.passwordHash) {
      return errorResponse('User not found', 404, request.headers.get('origin'))
    }

    const isValid = await bcrypt.compare(validated.currentPassword, user.passwordHash)
    if (!isValid) {
      logger.warn('Password change failed: Invalid current password', auth.userId)
      return errorResponse('Invalid current password', 401, request.headers.get('origin'))
    }

    const newPasswordHash = await bcrypt.hash(validated.newPassword, 10)

    await prisma.user.update({
      where: { id: auth.userId },
      data: {
        passwordHash: newPasswordHash,
      },
    })

    await createAuditLog(auth.userId, 'PASSWORD_CHANGE', {})

    return jsonResponse({ success: true, message: 'Password changed successfully' }, 200, request.headers.get('origin'))
  } catch (error: any) {
    if (error.name === 'ZodError') {
      logger.warn('Password change validation error:', error.errors)
      return errorResponse(error.errors[0].message, 400, request.headers.get('origin'))
    }
    logger.error('Change password error:', error)
    return errorResponse('Internal server error', 500, request.headers.get('origin'))
  }
}

Status Codes

Password changed successfully

Bad Request

Validation error (new password too short, etc.)

Unauthorized

Invalid current password or missing authentication

Not Found

User not found

Forbidden

Blocked by Arcjet

Example Request

curl -X POST https://auth.nullpass.xyz/api/auth/password \
  -H "Authorization: Bearer YOUR_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{
    "currentPassword": "oldpassword123",
    "newPassword": "newsecurepassword456"
  }'

Example Response

{
  "success": true,
  "message": "Password changed successfully"
}

Security Considerations

Current password must be verified before change
New password is hashed with bcrypt (10 rounds)
Rate limiting applied (2 requests per bucket)
All password changes are logged in audit trail
Old password hash is completely replaced (no history kept)

Audit Events

PASSWORD_CHANGE: Password successfully changed

Authorizations

Authorization

string

header

required

Bearer authentication header of the form Bearer <token>, where <token> is your auth token.

Body

application/json

currentPassword

string

required

newPassword

string

required

Minimum string length: 8

verificationCode

string

Required if 2FA is enabled

Response

200

Password changed successfully

Manage SessionsView and manage user sessions

Change Password

curl --request POST \
  --url https://auth.nullpass.xyz/api/auth/password \
  --header 'Authorization: Bearer <token>' \
  --header 'Content-Type: application/json' \
  --data '
{
  "currentPassword": "<string>",
  "newPassword": "<string>",
  "verificationCode": "<string>"
}
'

import requests

url = "https://auth.nullpass.xyz/api/auth/password"

payload = {
    "currentPassword": "<string>",
    "newPassword": "<string>",
    "verificationCode": "<string>"
}
headers = {
    "Authorization": "Bearer <token>",
    "Content-Type": "application/json"
}

response = requests.post(url, json=payload, headers=headers)

print(response.text)

const options = {
  method: 'POST',
  headers: {Authorization: 'Bearer <token>', 'Content-Type': 'application/json'},
  body: JSON.stringify({
    currentPassword: '<string>',
    newPassword: '<string>',
    verificationCode: '<string>'
  })
};

fetch('https://auth.nullpass.xyz/api/auth/password', options)
  .then(res => res.json())
  .then(res => console.log(res))
  .catch(err => console.error(err));

<?php

$curl = curl_init();

curl_setopt_array($curl, [
  CURLOPT_URL => "https://auth.nullpass.xyz/api/auth/password",
  CURLOPT_RETURNTRANSFER => true,
  CURLOPT_ENCODING => "",
  CURLOPT_MAXREDIRS => 10,
  CURLOPT_TIMEOUT => 30,
  CURLOPT_HTTP_VERSION => CURL_HTTP_VERSION_1_1,
  CURLOPT_CUSTOMREQUEST => "POST",
  CURLOPT_POSTFIELDS => json_encode([
    'currentPassword' => '<string>',
    'newPassword' => '<string>',
    'verificationCode' => '<string>'
  ]),
  CURLOPT_HTTPHEADER => [
    "Authorization: Bearer <token>",
    "Content-Type: application/json"
  ],
]);

$response = curl_exec($curl);
$err = curl_error($curl);

curl_close($curl);

if ($err) {
  echo "cURL Error #:" . $err;
} else {
  echo $response;
}

package main

import (
	"fmt"
	"strings"
	"net/http"
	"io"
)

func main() {

	url := "https://auth.nullpass.xyz/api/auth/password"

	payload := strings.NewReader("{\n  \"currentPassword\": \"<string>\",\n  \"newPassword\": \"<string>\",\n  \"verificationCode\": \"<string>\"\n}")

	req, _ := http.NewRequest("POST", url, payload)

	req.Header.Add("Authorization", "Bearer <token>")
	req.Header.Add("Content-Type", "application/json")

	res, _ := http.DefaultClient.Do(req)

	defer res.Body.Close()
	body, _ := io.ReadAll(res.Body)

	fmt.Println(string(body))

}

HttpResponse<String> response = Unirest.post("https://auth.nullpass.xyz/api/auth/password")
  .header("Authorization", "Bearer <token>")
  .header("Content-Type", "application/json")
  .body("{\n  \"currentPassword\": \"<string>\",\n  \"newPassword\": \"<string>\",\n  \"verificationCode\": \"<string>\"\n}")
  .asString();

require 'uri'
require 'net/http'

url = URI("https://auth.nullpass.xyz/api/auth/password")

http = Net::HTTP.new(url.host, url.port)
http.use_ssl = true

request = Net::HTTP::Post.new(url)
request["Authorization"] = 'Bearer <token>'
request["Content-Type"] = 'application/json'
request.body = "{\n  \"currentPassword\": \"<string>\",\n  \"newPassword\": \"<string>\",\n  \"verificationCode\": \"<string>\"\n}"

response = http.request(request)
puts response.read_body

Get Started

Authentication

Services

Webhooks

Account Management

Service Connection

Polar Integration

Admin

Advanced

Library

Endpoint

Overview

Request

Response

Implementation Details

Process Flow

Code Reference

Status Codes

Example Request

Example Response

Security Considerations

Audit Events

Authorizations

Body

Response

​Endpoint

​Overview

​Request

​Response

​Implementation Details

​Process Flow

​Code Reference

​Status Codes

​Example Request

​Example Response

​Security Considerations

​Audit Events

Authorizations

Body

Response

Endpoint

Overview

Request

Response

Implementation Details

Process Flow

Code Reference

Status Codes

Example Request

Example Response

Security Considerations

Audit Events