Skip to main content
POST
Change the authenticated user's password

Authorizations

Authorization
string
header
required

JWT Bearer token authentication. Include your access token in the Authorization header as: Bearer YOUR_ACCESS_TOKEN

Example:

Body

application/json

Change (or first set) the authenticated user's password (FLO-2735 G-2).

current_password is required by the server whenever the account has one, and must be absent-or-anything when it does not. It is deliberately not marked required here: the schema cannot see which case applies, and a 422 on a field the caller had no way to fill would be a worse answer than the current_password_required code the service returns.

new_password
string
required

The replacement password. Strength is validated by Supabase Auth, which owns the password policy, so the only bounds applied here are the lengths GoTrue itself will not accept outside.

Required string length: 8 - 72
current_password
string | null

The account's existing password. Required when the account has one; verified server-side before the new password is written. Omit for an account that has no password yet (a magic-link or freshly invited user).

Required string length: 1 - 128

Response

Password updated

What the account-settings password form is allowed to render (FLO-2735 G-2).

Both fields are read live from auth.users on every call rather than folded into GET /profile/me. Two reasons: the profile response is fetched on every page load and this is needed on exactly one screen, and has_password changes the moment a first password is set — a value cached alongside the profile would keep showing "Set a password" to someone who just set one.

has_password
boolean
required

Whether the Supabase Auth record already has a password. Mirrors the user.HasPassword() guard GoTrue applies before enforcing Require Current Password, so the form asks for a current password exactly when GoTrue would demand one. False for a magic-link-only or freshly invited account, which sets its first password with no current password to give.

is_sso_managed
boolean
required

Whether the Supabase Auth record is SSO-managed (auth.users.is_sso_user). GoTrue refuses email/phone/password updates for these outright with user_sso_managed, so the form is not rendered at all rather than offered and then rejected. Defaults false so an unknown state still shows a form whose failure is at least explained.