# Change user password

Canonical page: https://docs.ovok.com/api/authentication/change-user-password

`PATCH /v2/auth/change-password`

Changes the password of the signed-in user. Use it from an account settings screen where the user knows their current password.

**Auth:** bearer token.
**Scope:** the User of the token.

## Behaviour

- `oldPassword` must match the current password. A wrong `oldPassword`, or an account with no password set, gives 401.
- The new password may equal the old one.
- The password must have at least 12 characters, not counting spaces at either end, and must not be on Ovok's list of common and breached passwords. Any character is allowed and none is required. A refused password answers 422 with the error on `newPassword`.
- The route does not end existing sessions.
- The email address is not marked as verified by this route.
- The response is the updated `User` without its password hash.

## Example

```bash
curl -X PATCH 'https://api.sandbox.ovok.com/v2/auth/change-password' \
  -H 'Authorization: Bearer eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpYXQiOjE3NjcyNjg4MDAsImV4cCI6MTc2NzI3MjQwMH0.Ql3B_ztDvctlyZ2z0vp4sl3ExXRQGkzmxdmTAqxNzZk' \
  -H 'Content-Type: application/json' \
  -d '{
    "oldPassword": "Ex4mple-Passw0rd",
    "newPassword": "a-new-password"
  }'
```