---
title: "Reset password with token"
method: POST
path: "/api/auth/email/reset-password"
tags: ["Client"]
---

# Reset password with token

`POST /api/auth/email/reset-password`

Reset user password with a token. The token can be:
- Magic link token (64-character hex token from send-reset-password when method is 'link')
- Reset token (from exchange-reset-password-token after code verification when method is 'code')

Both token types use RESET_PASSWORD purpose and are verified the same way.

Flow summary:
- Code method: send-reset-password → exchange-reset-password-token → reset-password (with resetToken)
- Link method: send-reset-password → GET /api/auth/email/reset-password-link → reset-password

## Request body

- object
  - `newPassword` string, required — New password meeting configured requirements
  - `otp` string, required — Reset token (either from magic link or from exchange-reset-password-token endpoint)

## Response `200`

Password reset successfully

- object
  - `message` string

## Other responses

- `400` — Invalid request or password requirements not met
- `401` — Verification code/token expired or invalid

---

[API](https://skmtc.net/insforge/apis/insforge-authentication-api.md) · [All operations](https://skmtc.net/insforge/apis/insforge-authentication-api/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/insforge/insforge-authentication-api/versions/a935bb49f932/schema)