---
title: "Complete Password Recovery"
method: PUT
path: "/account/recovery"
tags: ["account"]
---

# Complete Password Recovery

`PUT /account/recovery`

Use this endpoint to complete the user account password reset. Both the **userId** and **secret** arguments will be passed as query parameters to the redirect URL you have provided when sending your request to the [POST /account/recovery](/docs/client/account#accountCreateRecovery) endpoint.

Please note that in order to avoid a [Redirect Attack](https://github.com/OWASP/CheatSheetSeries/blob/master/cheatsheets/Unvalidated_Redirects_and_Forwards_Cheat_Sheet.md) the only valid redirect URLs are the ones from domains you have set when adding your platforms in the console interface.

## Request body

- object
  - `password` string, required — New password. Must be between 6 to 32 chars.
  - `passwordAgain` string, required — New password again. Must be between 6 to 32 chars.
  - `secret` string, required — Valid reset token.
  - `userId` string, required — User account UID address.

## Response `200`

Token

- Token — Token
  - `$id` string, required — Token ID.
  - `expire` integer, required — Token expiration date in Unix timestamp.
  - `secret` string, required — Token secret key. This will return an empty string unless the response is returned using an API key or as part of a webhook payload.
  - `userId` string, required — User ID.

---

[API](https://skmtc.net/appwrite/apis/client.md) · [All operations](https://skmtc.net/appwrite/apis/client/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/appwrite/client/versions/b1c00a0bc3fb/schema)