---
title: "Exchange reset password code for reset token"
method: POST
path: "/api/auth/email/exchange-reset-password-token"
tags: ["Client"]
---

# Exchange reset password code for reset token

`POST /api/auth/email/exchange-reset-password-token`

Step 1 of two-step password reset flow (only used when resetPasswordMethod is 'code'):
1. Verify the 6-digit code sent to user's email
2. Return a reset token that can be used to actually reset the password

This endpoint is not used when resetPasswordMethod is 'link', because the browser reset-link flow uses the emailed link token directly.

## Request body

- object
  - `email` string, email, required
  - `code` string, required — 6-digit numeric code from email

## Response `200`

Code verified successfully, reset token returned

- object
  - `token` string — Reset token to be used in reset-password endpoint
  - `expiresAt` string, date-time — Token expiration timestamp

## Other responses

- `400` — Invalid request
- `401` — Invalid or expired code

---

[API](https://skmtc.net/insforge/apis/insforge-authentication-api.md) · [All operations](https://skmtc.net/insforge/apis/insforge-authentication-api/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/insforge/insforge-authentication-api/versions/a935bb49f932/schema)