Complete a password reset with an emailed token (consume → revoke → rewrite).
const url = 'https://api.tradr.cloud/api/auth/password-reset/complete';const options = { method: 'POST', headers: {'Content-Type': 'application/json'}, body: '{"password":"example","token":"example"}'};
try { const response = await fetch(url, options); const data = await response.json(); console.log(data);} catch (error) { console.error(error);}curl --request POST \ --url https://api.tradr.cloud/api/auth/password-reset/complete \ --header 'Content-Type: application/json' \ --data '{ "password": "example", "token": "example" }'Public. Rate limited by client IP (10 / 15 min, the login posture — REQ-4.7; token guessing is primarily throttled by the token’s 256-bit entropy + 60 min TTL). Atomically consumes the single-use token (REQ-4.3), revokes ALL of the account’s sessions (REQ-4.5), sets the new bcrypt password hash, and marks the account email-verified — a completed email-delivered reset proves mailbox control (D8). Expired, already-consumed, and unrecognized tokens are indistinguishable: one generic 400 INVALID_OR_EXPIRED_TOKEN (REQ-4.2). No auto-login — no session cookie is set; the page routes to login (D8). Fully functional when the instance has no email configured (D12 — consuming an existing token sends nothing).
Request Bodyrequired
Section titled “Request Bodyrequired”object
The new password (the shared registration policy).
The raw token from the emailed link’s URL fragment.
Examplegenerated
{ "password": "example", "token": "example"}Responses
Section titled “Responses”{ success: true } — password rewritten, all sessions revoked, no session cookie set.
Validation error
Rate limit reached (IP-keyed).