Change Password

Change the password for the authenticated account

POST /api/v1/auth/change-password

Change Password

cURL

curl --request POST \
  --url https://api.example.com/api/v1/auth/change-password \
  --header 'Content-Type: application/json' \
  --data '
{
  "currentPassword": "<string>",
  "newPassword": "<string>"
}
'

import requests

url = "https://api.example.com/api/v1/auth/change-password"

payload = {
    "currentPassword": "<string>",
    "newPassword": "<string>"
}
headers = {"Content-Type": "application/json"}

response = requests.post(url, json=payload, headers=headers)

print(response.text)

const options = {
  method: 'POST',
  headers: {'Content-Type': 'application/json'},
  body: JSON.stringify({currentPassword: '<string>', newPassword: '<string>'})
};

fetch('https://api.example.com/api/v1/auth/change-password', options)
  .then(res => res.json())
  .then(res => console.log(res))
  .catch(err => console.error(err));

<?php

$curl = curl_init();

curl_setopt_array($curl, [
  CURLOPT_URL => "https://api.example.com/api/v1/auth/change-password",
  CURLOPT_RETURNTRANSFER => true,
  CURLOPT_ENCODING => "",
  CURLOPT_MAXREDIRS => 10,
  CURLOPT_TIMEOUT => 30,
  CURLOPT_HTTP_VERSION => CURL_HTTP_VERSION_1_1,
  CURLOPT_CUSTOMREQUEST => "POST",
  CURLOPT_POSTFIELDS => json_encode([
    'currentPassword' => '<string>',
    'newPassword' => '<string>'
  ]),
  CURLOPT_HTTPHEADER => [
    "Content-Type: application/json"
  ],
]);

$response = curl_exec($curl);
$err = curl_error($curl);

curl_close($curl);

if ($err) {
  echo "cURL Error #:" . $err;
} else {
  echo $response;
}

package main

import (
	"fmt"
	"strings"
	"net/http"
	"io"
)

func main() {

	url := "https://api.example.com/api/v1/auth/change-password"

	payload := strings.NewReader("{\n  \"currentPassword\": \"<string>\",\n  \"newPassword\": \"<string>\"\n}")

	req, _ := http.NewRequest("POST", url, payload)

	req.Header.Add("Content-Type", "application/json")

	res, _ := http.DefaultClient.Do(req)

	defer res.Body.Close()
	body, _ := io.ReadAll(res.Body)

	fmt.Println(string(body))

}

HttpResponse<String> response = Unirest.post("https://api.example.com/api/v1/auth/change-password")
  .header("Content-Type", "application/json")
  .body("{\n  \"currentPassword\": \"<string>\",\n  \"newPassword\": \"<string>\"\n}")
  .asString();

require 'uri'
require 'net/http'

url = URI("https://api.example.com/api/v1/auth/change-password")

http = Net::HTTP.new(url.host, url.port)
http.use_ssl = true

request = Net::HTTP::Post.new(url)
request["Content-Type"] = 'application/json'
request.body = "{\n  \"currentPassword\": \"<string>\",\n  \"newPassword\": \"<string>\"\n}"

response = http.request(request)
puts response.read_body

Endpoint

POST /api/v1/auth/change-password

Base URL: http://localhost:3000/api/v1

This endpoint requires Bearer authentication.

Authentication

Include the access token in the Authorization header:

Authorization: Bearer YOUR_ACCESS_TOKEN

This endpoint works for both:

• Job Seekers
• Companies

Request Body

currentPassword · string · required

The current password for the authenticated account.

newPassword · string · required

The new password to set. Minimum 6 characters.

Request Shape

interface ChangePasswordDto {
  currentPassword: string;
  newPassword: string;
}

Example Request

POST /api/v1/auth/change-password
Authorization: Bearer YOUR_ACCESS_TOKEN
Content-Type: application/json

{
  "currentPassword": "old-password-123",
  "newPassword": "new-password-456"
}

Response

Success Response (200 OK)

{
  "success": true,
  "data": {
    "id": "550e8400-e29b-41d4-a716-446655440000",
    "email": "[e-mail]",
    "firstName": "John",
    "lastName": "Doe",
    "profileImageUrl": null,
    "isActive": true,
    "isVerified": true,
    "lastLoginAt": "2026-03-07T20:00:00.000Z",
    "createdAt": "2026-01-01T10:00:00.000Z",
    "updatedAt": "2026-03-07T21:00:00.000Z"
  },
  "message": "Password changed successfully",
  "meta": {
    "timestamp": "2026-04-23T20:00:00.000Z",
    "path": "/auth/change-password",
    "method": "POST"
  }
}

Response Notes

Current Implementation Detail: The success payload depends on the account type and repository implementation. Treat the success status and message as the primary confirmation that the password was changed.

What Happens

1. Find User

   The backend looks up the authenticated account in both job seeker and company tables.

2. Verify Current Password

   The provided currentPassword is compared against the stored password hash.

3. Hash New Password

   The new password is hashed before it is saved.
4. Update Password

   The backend updates the password for the authenticated account.

Error Responses

400 Bad Request - Validation Error

{
  "success": false,
  "error": {
    "message": [
      "currentPassword must be longer than or equal to 6 characters",
      "newPassword must be longer than or equal to 6 characters"
    ],
    "statusCode": 400,
    "timestamp": "2026-04-23T20:00:00.000Z",
    "path": "/auth/change-password",
    "method": "POST",
    "details": "Bad Request"
  }
}

401 Unauthorized - Not Authenticated

{
  "success": false,
  "error": {
    "message": "Unauthorized",
    "statusCode": 401,
    "timestamp": "2026-04-23T20:00:00.000Z",
    "path": "/auth/change-password",
    "method": "POST",
    "details": "Unauthorized"
  }
}

401 Unauthorized - Current Password Is Incorrect

{
  "success": false,
  "error": {
    "message": "Current password is incorrect",
    "statusCode": 401,
    "timestamp": "2026-04-23T20:00:00.000Z",
    "path": "/auth/change-password",
    "method": "POST",
    "details": "Unauthorized"
  }
}

404 Not Found - User Not Found

{
  "success": false,
  "error": {
    "message": "User not found",
    "statusCode": 404,
    "timestamp": "2026-04-23T20:00:00.000Z",
    "path": "/auth/change-password",
    "method": "POST",
    "details": "Not Found"
  }
}

500 Internal Server Error

{
  "success": false,
  "error": {
    "message": "Failed to update password",
    "statusCode": 500,
    "timestamp": "2026-04-23T20:00:00.000Z",
    "path": "/auth/change-password",
    "method": "POST",
    "details": "Internal Server Error"
  }
}

Validation Rules

Field	Rules
currentPassword	Minimum 6 characters
newPassword	Minimum 6 characters

Related Endpoints

• Login - Sign in with the new password after changing it
• Forgot Password - Use OTP-based recovery if the current password is unknown
• Logout - End the current session