Sign in
OpenAPI 3.1.0raw.githubusercontent.com2026-08-21155184608.2 KB

a4401e66e263

auth

Set Dashboard Password

Set or change the password the caller signs in to the dashboard with.

Always the caller's own identity. Supply email when it has no sign-in address yet, which is the state first boot leaves the operator in, and current_password when it already has a password and the request is authenticated by the session cookie. The master key in a header is what excuses current_password, which is how a forgotten password is recovered; it does not excuse email, because an identity with no address has nothing to sign in with whoever is asking. Setting a password for the first time retires master-key sign-in on this deployment.

Every other session this identity holds ends, the caller's own excepted, so a cookie stolen before the change does not outlive it.

put/v1/auth/password

Request body

current_passwordstring nullable

The password being replaced. Required when the identity already has one and the request is authenticated by the session cookie; ignored when the master key is sent in a header, which needs no proof of the old password (it still needs email when the identity has no sign-in address yet).

emailstring nullable

The address to sign in with. Required when the identity has none, which is the state first boot leaves the operator in, including when the master key is what authenticates the call. Resubmitting the address the identity already holds is accepted and ignored; only a different address is refused, because changing one is not supported yet.

new_passwordstring required

The password to sign in with from now on. At least 8 characters, and at most 72 bytes, which is bcrypt's ceiling.

Example request

{
  "email": "operator@example.com",
  "new_password": "a-real-password"
}

Response

Successful Response

emailstring required

The address this identity signs in with.

master_key_sign_in_retiredboolean required

Always true once this succeeds: some identity on this deployment now has a password, so POST /v1/auth/session no longer accepts the master key. It stays the credential for the management API.