---
title: "Set Dashboard Password"
method: PUT
path: "/v1/auth/password"
tags: ["auth"]
---

# Set Dashboard Password

`PUT /v1/auth/password`

Set or change the password the caller signs in to the dashboard with.

Always the caller's own identity. Supply ``email`` when it has no sign-in
address yet, which is the state first boot leaves the operator in, and
``current_password`` when it already has a password and the request is
authenticated by the session cookie. The master key in a header is what
excuses ``current_password``, which is how a forgotten password is
recovered; it does not excuse ``email``, because an identity with no address
has nothing to sign in with whoever is asking. Setting a password for the
first time retires master-key sign-in on this deployment.

Every other session this identity holds ends, the caller's own excepted, so
a cookie stolen before the change does not outlive it.

## Request body

- SetPasswordRequest — Set or change the signed-in identity's password. The example is the first-boot claim, because that is the call an operator makes first and the one whose required fields are not obvious from the schema: ``email`` is optional here in general and *required* when the identity has no address yet. Without it the generated Postman body carries only ``new_password``, which is the one shape that cannot complete the flow the docs walk through.
  - `current_password` string, nullable — The password being replaced. Required when the identity already has one and the request is authenticated by the session cookie; ignored when the master key is sent in a header, which needs no proof of the old password (it still needs `email` when the identity has no sign-in address yet).
  - `email` string, nullable — The address to sign in with. Required when the identity has none, which is the state first boot leaves the operator in, including when the master key is what authenticates the call. Resubmitting the address the identity already holds is accepted and ignored; only a *different* address is refused, because changing one is not supported yet.
  - `new_password` string, required — The password to sign in with from now on. At least 8 characters, and at most 72 bytes, which is bcrypt's ceiling.

## Response `200`

Successful Response

- PasswordResponse — What the identity signs in with now.
  - `email` string, required — The address this identity signs in with.
  - `master_key_sign_in_retired` boolean, required — Always true once this succeeds: some identity on this deployment now has a password, so POST /v1/auth/session no longer accepts the master key. It stays the credential for the management API.

## Other responses

- `422` — Validation Error

---

[API](https://skmtc.net/mozilla-ai/apis/otari.md) · [All operations](https://skmtc.net/mozilla-ai/apis/otari/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/mozilla-ai/otari/revisions/91764f0b41d6/schema)