v1auth contextCredential management
Password credential
PUT /v1/auth/credentials/password — first-time setup or change.
PUT /v1/auth/credentials/password covers both "set a password for the first time" and "change the existing one".
Request
| Parameter | Type | Required | Notes |
|---|---|---|---|
current_password | string | Conditional | Required when a password already exists, 1–128 chars |
new_password | string | ✅ | New password, 8–128 chars |
curl -X PUT 'https://id.example.com/v1/auth/credentials/password' \
-H "Authorization: Bearer $ACCESS_TOKEN" \
-H 'Content-Type: application/json' \
-d '{"current_password":"old","new_password":"new-strong-pass"}'{ "success": true, "credential": { "id": "cred_...", "type": "password" } }Whether it is required is decided by the server
Whether the account has a password is server state. A client must not be able to skip the current-password check by sending an "I have no password" flag.
So current_password fails the request when a password exists, and is ignored during first-time setup.
Requirements
- Step-up:
max_age=300; - Password strength has a hard minimum; weak passwords are rejected, not "warned about but allowed";
- A successful write is audited as
password.change.
Related
- Other credential types: Credential management
- When the password is lost and the user cannot sign in: Password reset