Reset Password
Complete a password reset using the token delivered by /auth/forgot-password. Tokens expire after one hour, are invalidated after first use, and are bound to the user that requested them — they can't be replayed across accounts.
On success the password is bcrypt-hashed and persisted; existing JWTs and sessions are not revoked automatically (caller can do this via the password-change flow if needed). Rate-limited per IP to prevent token brute-force attacks.
Request body
token string Req
Reset token from the email link. Single-use; expires one hour after issuance.
new_password string Req
New password. Minimum 8 characters; common-passwords / complexity rules may apply per deployment policy.
Response (200 OK)
message string
Confirmation message. The next call to /auth/login with the new password should succeed.
Errors
400 Bad Request
Missing
token / new_password, password shorter than 8 characters, invalid JSON, or invalid/expired/already-used reset token.429 Too Many Requests
Per-IP rate limit hit (token brute-force protection).
500
bcrypt or database error. Safe to retry.
Request
curl -X POST "https://api.ngris.com/v1/auth/reset-password" \
-H "Content-Type: application/json" \
-d '{
"token": "<reset-token-from-email>",
"new_password": "MyNewS3cur3P@ss!"
}'
Python
from ngris import Ngris
client = Ngris(api_key="placeholder")
client.auth.reset_password(
token="<reset-token-from-email>",
new_password="MyNewS3cur3P@ss!",
)
Response — 200 OK
{
"message": "Password reset successfully."
}
Error — invalid token
Invalid or expired reset token