Complete a password reset with an emailed token (consume → revoke → rewrite).
const url = 'https://api.tradr.cloud/api/auth/password-reset/complete';const options = { method: 'POST', headers: {'Content-Type': 'application/json'}, body: '{"password":"example","token":"example"}'};
try { const response = await fetch(url, options); const data = await response.json(); console.log(data);} catch (error) { console.error(error);}curl --request POST \ --url https://api.tradr.cloud/api/auth/password-reset/complete \ --header 'Content-Type: application/json' \ --data '{ "password": "example", "token": "example" }'Public. Rate limited by client IP (10 / 15 min, the login posture — token guessing is primarily throttled by the token’s 256-bit entropy + 60 min TTL). Atomically consumes the single-use token, revokes ALL of the account’s sessions, sets the new bcrypt password hash, and marks the account email-verified — a completed email-delivered reset proves mailbox control. Expired, already-consumed, and unrecognized tokens are indistinguishable: one generic 400 INVALID_OR_EXPIRED_TOKEN. No auto-login — no session cookie is set; the page routes to login. Fully functional when the instance has no email configured (consuming an existing token sends nothing).
Request Bodyrequired
Section titled “Request Bodyrequired”object
The new password (the shared registration policy).
The raw token from the emailed link’s URL fragment.
Examplegenerated
{ "password": "example", "token": "example"}Responses
Section titled “Responses”{ success: true } — password rewritten, all sessions revoked, no session cookie set.
Validation error
Rate limit reached (IP-keyed).