Add a password

Sets the first password on an account created through a mailed code or an identity provider. The password is 8 to 128 characters and is refused when it appears in a public breach corpus. Refused when the account already has a password. Use the password-change flow for an existing password. Requires a recent identity confirmation.

POST /v1/auth/password

Authorization

__Host-better-auth.session_token API key · cookie required

Dashboard session cookie set at sign-in. An operation that lists only this scheme needs a person: API keys and machine credentials are refused. The same session token also works as Authorization: Bearer.

Request body

• required application/json

• password string required

  • min length 8 · max length 128

Responses

• 200 Response for status 200

• '$schema' string

  • Canonical JSON Schema URL for this response body. The server also sends it in the Link: rel="describedby" response header.

• data object required

• passwordSet boolean required - defaultError. Every 4xx and 5xx response is one RFC 9457 problem document served as application/problem+json.

• '$schema' string

  • Canonical JSON Schema URL for this response body. The server also sends it in the Link: rel="describedby" response header.

• type string required

  • URL of the documentation page for this error. Derived from code.

• title string required

  • Human-readable name of the error type. Derived from code.

• status integer required

  • HTTP status of the response, repeated in the body.
    • min -9007199254740991 · max 9007199254740991

• detail string required

  • What went wrong in this request.

• code string required

  • Stable snake_case error code. Match on this, not on detail.

• pointer string

  • RFC 6901 JSON Pointer to the request field or batch entry that failed, for example /files/37/path. Present on validation failures.

• details object

  • Machine-readable context keyed by the error code.

• suggestions string[]

  • Recovery steps safe to show to a person.

• next string[]

  • Commands or API requests to run next, usable as written.

• requestId string required

  • ID of this request, from the X-Request-Id header or generated. Quote it when contacting support.

Try it

Server
Base URL https://api.spacefast.com
Custom base URL Overrides the selected server when set.

Authorization

• API key Remember on this device Include my values in samples

Body

• application/json

• password string*

Request Examples

cURL

curl -X POST "https://api.spacefast.com/v1/auth/password" \
  -H "Cookie: __Host-better-auth.session_token=YOUR_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{
  "password": "stringst"
}'

JavaScript

const response = await fetch("https://api.spacefast.com/v1/auth/password", {
  method: "POST",
  headers: {
    "Cookie": "__Host-better-auth.session_token=YOUR_API_KEY",
    "Content-Type": "application/json"
  },
  body: "{\n  \"password\": \"stringst\"\n}"
});

Python

import requests

response = requests.post(
    "https://api.spacefast.com/v1/auth/password",
    headers={
        "Cookie": "__Host-better-auth.session_token=YOUR_API_KEY",
        "Content-Type": "application/json"
    },
    data="{\n  \"password\": \"stringst\"\n}",
)

Response

• 200 default

  {
    "$schema": "http://example.com",
    "data": {
      "passwordSet": true
    }
  }

  {
    "$schema": "http://example.com",
    "type": "string",
    "title": "string",
    "status": -9007199254740991,
    "detail": "string",
    "code": "string",
    "pointer": "string",
    "details": {
      "property1": null,
      "property2": null
    },
    "suggestions": [\
      "string" \
    ],
    "next": [\
      "string" \
    ],
    "requestId": "string"
  }