Complete a password reset

POST 
/api/v1/auth/reset-password/:challengeId/complete

Requires the restricted safebucket_mfa_token from /validate (challenge ID in the JWT must match the path). Revokes all existing sessions and issues new full access/refresh cookies.

Request

Responses

204

Password reset; new auth cookies issued

Response Headers

Set-Cookie

Sets safebucket_access_token and safebucket_refresh_token cookies (HttpOnly, SameSite=Lax, Secure when TLS is enabled).

400

Challenge ID mismatch or invalid/expired challenge (INVALID_REQUEST)

403

MFA required but not completed (MFA_REQUIRED)