Set password
POST
/v1/me/set-password
Add a first password to the signed-in user's account when it has none (it was created with Google or Apple). No current password is required — there is none. The new password must meet the minimum-strength rule (too weak → 400). An account that already has a password can't add another (409 password_already_set) — it must use change password. On success a "password added" alert is emailed to the account address and every other session is signed out; the response returns a fresh token for this session. Requires an interactive login: this security action can't be performed with an API key (403 interactive_auth_required).
Authorizations
Bearer
JWT bearer token from POST /v1/auth/login.
Type
HTTP (bearer)
or
ApiKey
Scoped API key for non-interactive clients (issued by PBI #1426).
Type
API Key (header: X-Api-Key)
Request Body
application/json
Set-password payload (POST /me/set-password, #2154) — the first password for an OAuth-only account.
The password to set (must meet the strength rule). No current password: there is none.
Responses
OK
application/json
Password-change result (POST /me/change-password, #2124).
true when the password was changed.
A fresh JWT for the acting session (#2126): changing the password invalidates every
other session, so the caller swaps its token for this one to stay signed in. null only in
the unexpected case that the just-changed account could not be reloaded.