API DocsAPI Docs / PUT /api/v1/auth/change-password

PUT /api/v1/auth/change-password

Allows the currently authenticated user to change their password.

Permissions

This endpoint requires authentication but does not require any special permissions. Users can only change their own password.

Request Body Parameters

Notes:

• The current_password must match the user's existing password.
• The password field must be at least 8 characters long.
• The password_confirmation must exactly match the password field.

Request Example

PUT /api/v1/auth/change-password
Authorization: Bearer {token}
Content-Type: application/json

{
  "current_password": "currentpassword123",
  "password": "newpassword123",
  "password_confirmation": "newpassword123"
}

Response

200 OK

Returns a success message when the password is changed successfully.

Example

{
  "message": "Password changed successfully."
}

Error Responses

422 Validation Error Examples

{
  "message": "The current password field is required.",
  "errors": {
    "current_password": ["The current password field is required."]
  }
}

{
  "message": "The password is incorrect.",
  "errors": {
    "current_password": ["The password is incorrect."]
  }
}

{
  "message": "The password field must be at least 8 characters.",
  "errors": {
    "password": ["The password field must be at least 8 characters."]
  }
}

{
  "message": "The password confirmation field must match password.",
  "errors": {
    "password": ["The password confirmation field must match password."]
  }
}

Sessions after a change

A successful change signs out every other session: every Sanctum token except the one that made this request is revoked, and so is every Passport credential (MCP clients' access tokens, refresh tokens and unredeemed authorization codes). The device that changed the password stays signed in; every other device and MCP client must sign in or re-authorize with the new password. A rejected change (wrong current password, validation error) revokes nothing.

Related Resources

• PUT /api/v1/auth/me - Update user profile information
• POST /api/v1/auth/login - User login