Change your own password

Requires any authenticated role. Verifies current_password first (401 on mismatch), then invalidates every other session for this user — the session making this request stays valid.

Body

Request

curl -X PATCH localhost:8000/auth/users/me/password \
  -H "Authorization: Bearer $TOKEN" -H 'Content-Type: application/json' \
  -d '{"current_password":"admin","new_password":"<a strong password>"}'

Responses

{ "message": "password updated" }

{ "detail": "invalid current password" }