در حال بارگذاری…
Allows the currently authenticated user to change their password.
This endpoint requires authentication but does not require any special permissions. Users can only change their own password.
| Name | Type | Required | Description |
|---|---|---|---|
current_password | string | Yes | The user's current password |
password | string | Yes | The new password (minimum 8 characters) |
password_confirmation | string | Yes |
| Confirmation of the new password |
Notes:
current_password must match the user's existing password.password field must be at least 8 characters long.password_confirmation must exactly match the password field.PUT /api/v1/auth/change-password
Authorization: Bearer {token}
Content-Type: application/json
{
"current_password": "currentpassword123",
"password": "newpassword123",
"password_confirmation": "newpassword123"
}
Returns a success message when the password is changed successfully.
{
"message": "Password changed successfully."
}
| Status | Description | Reference |
|---|---|---|
| 401 | Unauthorized (not authenticated) | Authentication error |
| 422 | Validation error (invalid input) | See below |
{
"message": "The current password field is required.",
"errors": {
"current_password": ["The current password field is required."]
}
}
{
"message": "The password is incorrect.",
"errors": {
"current_password": ["The password is incorrect."]
}
}
{
"message": "The password field must be at least 8 characters.",
"errors": {
"password": ["The password field must be at least 8 characters."]
}
}
{
"message": "The password confirmation field must match password.",
"errors": {
"password": ["The password confirmation field must match password."]
}
}
A successful change signs out every other session: every Sanctum token except the one that made this request is revoked, and so is every Passport credential (MCP clients' access tokens, refresh tokens and unredeemed authorization codes). The device that changed the password stays signed in; every other device and MCP client must sign in or re-authorize with the new password. A rejected change (wrong current password, validation error) revokes nothing.