> **Can't find what you're looking for?** Use `search_docs` on the docs MCP server at `https://www.openfort.io/api/mcp` to find what you need.
>
> **Have feedback?** Use `submit_feedback` on the same MCP server.

# Password and Email

Manage credentials: change or reset passwords and change or verify email addresses.

## Forget password

`POST /iam/v2/auth/forget-password`

Send a password reset email to the user

### Request body (required) (`application/json`)

- `email` `string` _(required)_: The email address of the user to send a password reset email to
- `redirectTo` `string | null`: The URL to redirect the user to reset their password. If the token isn't valid or expired, it'll be redirected with a query parameter `?error=INVALID_TOKEN`. If the token is valid, it'll be redirected with a query parameter `?token=VALID_TOKEN

### Responses

#### `200`: Success

Body (`application/json`):

- `status` `boolean`
- `message` `string`

#### `400`: Bad Request. Usually due to missing parameters, or invalid parameters.

Body (`application/json`):

- `message` `string` _(required)_

#### `401`: Unauthorized. Due to missing or invalid authentication.

Body (`application/json`):

- `message` `string` _(required)_

#### `403`: Forbidden. You do not have permission to access this resource or to perform this action.

Body (`application/json`):

- `message` `string`

#### `404`: Not Found. The requested resource was not found.

Body (`application/json`):

- `message` `string`

#### `429`: Too Many Requests. You have exceeded the rate limit. Try again later.

Body (`application/json`):

- `message` `string`

#### `500`: Internal Server Error. This is a problem with the server that you cannot fix.

Body (`application/json`):

- `message` `string`

### Example request

```bash
curl https://api.openfort.io/iam/v2/auth/forget-password \
  --request POST \
  --header 'Content-Type: application/json' \
  --data '{
  "email": "string",
  "redirectTo": "string"
}'
```

```ts
fetch('https://api.openfort.io/iam/v2/auth/forget-password', {
  method: 'POST',
  headers: {
    'Content-Type': 'application/json'
  },
  body: JSON.stringify({
    email: 'string',
    redirectTo: 'string'
  })
})
```

## Reset password

`POST /iam/v2/auth/reset-password`

Reset the password for a user

### Request body (required) (`application/json`)

- `newPassword` `string` _(required)_: The new password to set
- `token` `string | null`: The token to reset the password

### Responses

#### `200`: Success

Body (`application/json`):

- `status` `boolean` _(required)_: Indicates whether the password was successfully reset

#### `400`: Bad Request. Usually due to missing parameters, or invalid parameters.

Body (`application/json`):

- `message` `string` _(required)_

#### `401`: Unauthorized. Due to missing or invalid authentication.

Body (`application/json`):

- `message` `string` _(required)_

#### `403`: Forbidden. You do not have permission to access this resource or to perform this action.

Body (`application/json`):

- `message` `string`

#### `404`: Not Found. The requested resource was not found.

Body (`application/json`):

- `message` `string`

#### `429`: Too Many Requests. You have exceeded the rate limit. Try again later.

Body (`application/json`):

- `message` `string`

#### `500`: Internal Server Error. This is a problem with the server that you cannot fix.

Body (`application/json`):

- `message` `string`

### Example request

```bash
curl https://api.openfort.io/iam/v2/auth/reset-password \
  --request POST \
  --header 'Content-Type: application/json' \
  --data '{
  "newPassword": "string",
  "token": "string"
}'
```

```ts
fetch('https://api.openfort.io/iam/v2/auth/reset-password', {
  method: 'POST',
  headers: {
    'Content-Type': 'application/json'
  },
  body: JSON.stringify({
    newPassword: 'string',
    token: 'string'
  })
})
```

## Verify email

`GET /iam/v2/auth/verify-email`

Verify the email of the user.
Usually this endpoint is called when user clicks 'Verify email' link from the letter.

### Query parameters

- `token` `string` _(required)_: The token to verify the email
- `callbackURL` `string`: The URL to redirect to after email verification

### Responses

#### `200`: Success

Body (`application/json`):

- `user` `object` _(required)_
  - `id` `string` _(required)_: User ID
  - `email` `string` _(required)_: User email
  - `name` `string` _(required)_: User name
  - `image` `string` _(required)_: User image URL
  - `emailVerified` `boolean` _(required)_: Indicates if the user email is verified
  - `createdAt` `string` _(required)_: User creation date
  - `updatedAt` `string` _(required)_: User update date
- `status` `boolean` _(required)_: Indicates if the email was verified successfully

#### `400`: Bad Request. Usually due to missing parameters, or invalid parameters.

Body (`application/json`):

- `message` `string` _(required)_

#### `401`: Unauthorized. Due to missing or invalid authentication.

Body (`application/json`):

- `message` `string` _(required)_

#### `403`: Forbidden. You do not have permission to access this resource or to perform this action.

Body (`application/json`):

- `message` `string`

#### `404`: Not Found. The requested resource was not found.

Body (`application/json`):

- `message` `string`

#### `429`: Too Many Requests. You have exceeded the rate limit. Try again later.

Body (`application/json`):

- `message` `string`

#### `500`: Internal Server Error. This is a problem with the server that you cannot fix.

Body (`application/json`):

- `message` `string`

### Example request

```bash
curl 'https://api.openfort.io/iam/v2/auth/verify-email?token=string&callbackURL=https://example.com/welcome'
```

```ts
fetch('https://api.openfort.io/iam/v2/auth/verify-email?token=string&callbackURL=https://example.com/welcome')
```

## Send verification email

`POST /iam/v2/auth/send-verification-email`

Send a verification email to the user

### Request body (`application/json`)

- `email` `string` _(required)_: The email to send the verification email to
- `callbackURL` `string | null`: The URL to use for email verification callback

### Responses

#### `200`: Success

Body (`application/json`):

- `status` `boolean`: Indicates if the email was sent successfully

#### `400`: Bad Request

Body (`application/json`):

- `message` `string`: Error message

#### `401`: Unauthorized. Due to missing or invalid authentication.

Body (`application/json`):

- `message` `string` _(required)_

#### `403`: Forbidden. You do not have permission to access this resource or to perform this action.

Body (`application/json`):

- `message` `string`

#### `404`: Not Found. The requested resource was not found.

Body (`application/json`):

- `message` `string`

#### `429`: Too Many Requests. You have exceeded the rate limit. Try again later.

Body (`application/json`):

- `message` `string`

#### `500`: Internal Server Error. This is a problem with the server that you cannot fix.

Body (`application/json`):

- `message` `string`

### Example request

```bash
curl https://api.openfort.io/iam/v2/auth/send-verification-email \
  --request POST \
  --header 'Content-Type: application/json' \
  --data '{
  "email": "user@example.com",
  "callbackURL": "https://example.com/callback"
}'
```

```ts
fetch('https://api.openfort.io/iam/v2/auth/send-verification-email', {
  method: 'POST',
  headers: {
    'Content-Type': 'application/json'
  },
  body: JSON.stringify({
    email: 'user@example.com',
    callbackURL: 'https://example.com/callback'
  })
})
```

## Change email

`POST /iam/v2/auth/change-email`

Change user's email

### Request body (required) (`application/json`)

- `newEmail` `string` _(required)_: The new email address to set must be a valid email address
- `callbackURL` `string | null`: The URL to redirect to after email verification

### Responses

#### `200`: Email change request processed successfully

Body (`application/json`):

- `status` `boolean` _(required)_: Indicates if the request was successful
- `message` `string | null`: Status message of the email change process

#### `400`: Bad Request. Usually due to missing parameters, or invalid parameters.

Body (`application/json`):

- `message` `string` _(required)_

#### `401`: Unauthorized. Due to missing or invalid authentication.

Body (`application/json`):

- `message` `string` _(required)_

#### `403`: Forbidden. You do not have permission to access this resource or to perform this action.

Body (`application/json`):

- `message` `string`

#### `404`: Not Found. The requested resource was not found.

Body (`application/json`):

- `message` `string`

#### `422`: Unprocessable Entity. Email already exists

Body (`application/json`):

- `message` `string`

#### `429`: Too Many Requests. You have exceeded the rate limit. Try again later.

Body (`application/json`):

- `message` `string`

#### `500`: Internal Server Error. This is a problem with the server that you cannot fix.

Body (`application/json`):

- `message` `string`

### Example request

```bash
curl https://api.openfort.io/iam/v2/auth/change-email \
  --request POST \
  --header 'Content-Type: application/json' \
  --data '{
  "newEmail": "string",
  "callbackURL": "string"
}'
```

```ts
fetch('https://api.openfort.io/iam/v2/auth/change-email', {
  method: 'POST',
  headers: {
    'Content-Type': 'application/json'
  },
  body: JSON.stringify({
    newEmail: 'string',
    callbackURL: 'string'
  })
})
```

## Change password

`POST /iam/v2/auth/change-password`

Change the password of the user

### Request body (required) (`application/json`)

- `newPassword` `string` _(required)_: The new password to set
- `currentPassword` `string` _(required)_: The current password is required
- `revokeOtherSessions` `boolean | null`: Must be a boolean value

### Responses

#### `200`: Password successfully changed

Body (`application/json`):

- `token` `string | null`: New session token if other sessions were revoked
- `user` `object` _(required)_
  - `id` `string` _(required)_
  - `name` `string` _(required)_
  - `email` `string` _(required)_
  - `emailVerified` `boolean`
  - `image` `string`
  - `createdAt` `string` _(required)_
  - `updatedAt` `string` _(required)_
  - `isAnonymous` `boolean`
  - `phoneNumber` `string`
  - `phoneNumberVerified` `boolean`

#### `400`: Bad Request. Usually due to missing parameters, or invalid parameters.

Body (`application/json`):

- `message` `string` _(required)_

#### `401`: Unauthorized. Due to missing or invalid authentication.

Body (`application/json`):

- `message` `string` _(required)_

#### `403`: Forbidden. You do not have permission to access this resource or to perform this action.

Body (`application/json`):

- `message` `string`

#### `404`: Not Found. The requested resource was not found.

Body (`application/json`):

- `message` `string`

#### `429`: Too Many Requests. You have exceeded the rate limit. Try again later.

Body (`application/json`):

- `message` `string`

#### `500`: Internal Server Error. This is a problem with the server that you cannot fix.

Body (`application/json`):

- `message` `string`

### Example request

```bash
curl https://api.openfort.io/iam/v2/auth/change-password \
  --request POST \
  --header 'Content-Type: application/json' \
  --data '{
  "newPassword": "string",
  "currentPassword": "string",
  "revokeOtherSessions": true
}'
```

```ts
fetch('https://api.openfort.io/iam/v2/auth/change-password', {
  method: 'POST',
  headers: {
    'Content-Type': 'application/json'
  },
  body: JSON.stringify({
    newPassword: 'string',
    currentPassword: 'string',
    revokeOtherSessions: true
  })
})
```

## Reset password callback

`GET /iam/v2/auth/reset-password/{token}`

Redirects the user to the callback URL with the token

### Path parameters

- `token` `string` _(required)_

### Query parameters

- `callbackURL` `string`

### Responses

#### `200`: Success

Body (`application/json`):

- `token` `string`

#### `400`: Bad Request. Usually due to missing parameters, or invalid parameters.

Body (`application/json`):

- `message` `string` _(required)_

#### `401`: Unauthorized. Due to missing or invalid authentication.

Body (`application/json`):

- `message` `string` _(required)_

#### `403`: Forbidden. You do not have permission to access this resource or to perform this action.

Body (`application/json`):

- `message` `string`

#### `404`: Not Found. The requested resource was not found.

Body (`application/json`):

- `message` `string`

#### `429`: Too Many Requests. You have exceeded the rate limit. Try again later.

Body (`application/json`):

- `message` `string`

#### `500`: Internal Server Error. This is a problem with the server that you cannot fix.

Body (`application/json`):

- `message` `string`

### Example request

```bash
curl 'https://api.openfort.io/iam/v2/auth/reset-password/string?callbackURL=https://example.com/welcome'
```

```ts
fetch('https://api.openfort.io/iam/v2/auth/reset-password/string?callbackURL=https://example.com/welcome')
```

## Request password reset

`POST /iam/v2/auth/request-password-reset`

Send a password reset email to the user

### Request body (required) (`application/json`)

- `email` `string` _(required)_: The email address of the user to send a password reset email to
- `redirectTo` `string | null`: The URL to redirect the user to reset their password. If the token isn't valid or expired, it'll be redirected with a query parameter `?error=INVALID_TOKEN`. If the token is valid, it'll be redirected with a query parameter `?token=VALID_TOKEN

### Responses

#### `200`: Success

Body (`application/json`):

- `status` `boolean`
- `message` `string`

#### `400`: Bad Request. Usually due to missing parameters, or invalid parameters.

Body (`application/json`):

- `message` `string` _(required)_

#### `401`: Unauthorized. Due to missing or invalid authentication.

Body (`application/json`):

- `message` `string` _(required)_

#### `403`: Forbidden. You do not have permission to access this resource or to perform this action.

Body (`application/json`):

- `message` `string`

#### `404`: Not Found. The requested resource was not found.

Body (`application/json`):

- `message` `string`

#### `429`: Too Many Requests. You have exceeded the rate limit. Try again later.

Body (`application/json`):

- `message` `string`

#### `500`: Internal Server Error. This is a problem with the server that you cannot fix.

Body (`application/json`):

- `message` `string`

### Example request

```bash
curl https://api.openfort.io/iam/v2/auth/request-password-reset \
  --request POST \
  --header 'Content-Type: application/json' \
  --data '{
  "email": "string",
  "redirectTo": "string"
}'
```

```ts
fetch('https://api.openfort.io/iam/v2/auth/request-password-reset', {
  method: 'POST',
  headers: {
    'Content-Type': 'application/json'
  },
  body: JSON.stringify({
    email: 'string',
    redirectTo: 'string'
  })
})
```

## Request password reset with email OTP

`POST /iam/v2/auth/forget-password/email-otp`

Send a password reset OTP to the user

### Request body (required) (`application/json`)

- `email` `string` _(required)_: Email address to send the OTP

### Responses

#### `200`: Success

Body (`application/json`):

- `success` `boolean`: Indicates if the OTP was sent successfully

#### `400`: Bad Request. Usually due to missing parameters, or invalid parameters.

Body (`application/json`):

- `message` `string` _(required)_

#### `401`: Unauthorized. Due to missing or invalid authentication.

Body (`application/json`):

- `message` `string` _(required)_

#### `403`: Forbidden. You do not have permission to access this resource or to perform this action.

Body (`application/json`):

- `message` `string`

#### `404`: Not Found. The requested resource was not found.

Body (`application/json`):

- `message` `string`

#### `429`: Too Many Requests. You have exceeded the rate limit. Try again later.

Body (`application/json`):

- `message` `string`

#### `500`: Internal Server Error. This is a problem with the server that you cannot fix.

Body (`application/json`):

- `message` `string`

### Example request

```bash
curl https://api.openfort.io/iam/v2/auth/forget-password/email-otp \
  --request POST \
  --header 'Content-Type: application/json' \
  --data '{
  "email": "string"
}'
```

```ts
fetch('https://api.openfort.io/iam/v2/auth/forget-password/email-otp', {
  method: 'POST',
  headers: {
    'Content-Type': 'application/json'
  },
  body: JSON.stringify({
    email: 'string'
  })
})
```