---
title: "Allows a non-admin user to reset their password without web access to the main site"
method: GET
path: "/me/lost-password"
tags: ["Authentication"]
---

# Allows a non-admin user to reset their password without web access to the main site

`GET /me/lost-password`

Sends a new password to the account's email address. The `auth` value here is a one-time reset token (`sha256(username . sha256(email))`), not a session token or API key, which is why no security scheme applies. **Send this as a POST where possible** -- the token is a credential and a GET puts it in server logs, proxy logs and browser history where it can be reused. Note the request also triggers a side effect (the reset email), so avoid link prefetchers.

## Query parameters

- `auth` string, required

## Response `200`

Success

- SuccessResponse
  - `success` string

## Other responses

- `400` — HTTP 400 Bad Request (errors 4705, 4710).
- `401` — HTTP 401 Unauthorized (error 4701).
- `403` — HTTP 403 Forbidden (errors 4700, 4703, 4742).
- `500` — HTTP 500 Internal Server Error (error 4702).

---

[API](https://skmtc.net/ampache/apis/ampache-rest-api.md) · [All operations](https://skmtc.net/ampache/apis/ampache-rest-api/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/ampache/ampache-rest-api/revisions/535feee32afb/schema)