Reset Visitor Password

Sets a new password using the reset token and signs the visitor in, returning an access token and a refresh token.

POST/v1/auth/reset-password

Authentication

Public key?key=pk_…

Public key in the `key` query parameter. No OAuth, no secret.

Edge cache: no-store

Query Parameters

keystring

required

The site's public key (pk_…). It selects the account. Safe to ship to the browser.

Body Parameters

tokenstring

required

The 32-character reset token (from the email link or from Verify Reset Code).

passwordstring

required

The new password, 8 to 20 characters.

confirmPasswordstring

required

The same password again. A mismatch is rejected.

Responses

200Success

application/json

titlestring

hideToastboolean

typestring

variantstring

messagestring

accessTokenstring

refreshTokenstring

expiresInnumber

Errors

400`Invalid Verification Code` (unknown or used token), or a validation error such as `Passwords don't match` (inner `status` 422, with `errors`).

401Missing or invalid public key.

403The Panda account is not active. The body also carries `code: "TENANT_INACTIVE"`.

Notes

The token works once. The old password stops working right away.
Tokens: `accessToken` lasts 1 hour (`expiresIn` is in seconds). `refreshToken` lasts 60 days and renews every time you refresh. Send the access token as `Authorization: Bearer`, never as a cookie.

Request

curl --request POST \
  --url "https://api.pandaidx.com/v1/auth/reset-password?key={{public_key}}" \
  --header "Content-Type: application/json" \
  --data '{"token":"0123456789abcdef0123456789abcdef","password":"ChangeMe-Example-2","confirmPassword":"ChangeMe-Example-2"}'

Response200 OK

{
  "title": "Password changed successfully",
  "hideToast": false,
  "type": "success",
  "variant": "default",
  "message": "Password changed successfully",
  "accessToken": "v1.example-access-token",
  "refreshToken": "example-refresh-token",
  "expiresIn": 3600
}