Change password
curl --request POST \
--url https://aropay.aro.media/api/v1/me/password \
--header 'Content-Type: application/json' \
--cookie aropay_session= \
--data '
{
"currentPassword": "<string>",
"newPassword": "<string>"
}
'const options = {
method: 'POST',
headers: {cookie: 'aropay_session=', 'Content-Type': 'application/json'},
body: JSON.stringify({currentPassword: '<string>', newPassword: '<string>'})
};
fetch('https://aropay.aro.media/api/v1/me/password', options)
.then(res => res.json())
.then(res => console.log(res))
.catch(err => console.error(err));import requests
url = "https://aropay.aro.media/api/v1/me/password"
payload = {
"currentPassword": "<string>",
"newPassword": "<string>"
}
headers = {
"cookie": "aropay_session=",
"Content-Type": "application/json"
}
response = requests.post(url, json=payload, headers=headers)
print(response.text){
"ok": true,
"data": {
"user": {
"id": "ckusr0001abcd",
"email": "jsmith@example.com",
"name": "<string>",
"company": "<string>",
"mustChangePassword": true,
"totpEnabled": true,
"lastLoginAt": "2023-11-07T05:31:56Z",
"createdAt": "2023-11-07T05:31:56Z"
},
"revoked": {
"apiKeys": 123,
"passkeys": 123
}
}
}
Profile & security
Change password
Session-only. Change the account password. Policy: 10–200
characters including an uppercase letter, a lowercase letter, and a
digit. Success bumps the account’s token version (every other session
is invalidated), revokes every API key, removes the account’s
passkeys when removePasskeys is true, and refreshes the current
session cookie. A wrong currentPassword counts toward the step-up
password lock, not sign-in’s, so failed sign-ins never block a
signed-in password change. The 2FA code lock is left as it is.
POST
/
me
/
password
Change password
curl --request POST \
--url https://aropay.aro.media/api/v1/me/password \
--header 'Content-Type: application/json' \
--cookie aropay_session= \
--data '
{
"currentPassword": "<string>",
"newPassword": "<string>"
}
'const options = {
method: 'POST',
headers: {cookie: 'aropay_session=', 'Content-Type': 'application/json'},
body: JSON.stringify({currentPassword: '<string>', newPassword: '<string>'})
};
fetch('https://aropay.aro.media/api/v1/me/password', options)
.then(res => res.json())
.then(res => console.log(res))
.catch(err => console.error(err));import requests
url = "https://aropay.aro.media/api/v1/me/password"
payload = {
"currentPassword": "<string>",
"newPassword": "<string>"
}
headers = {
"cookie": "aropay_session=",
"Content-Type": "application/json"
}
response = requests.post(url, json=payload, headers=headers)
print(response.text){
"ok": true,
"data": {
"user": {
"id": "ckusr0001abcd",
"email": "jsmith@example.com",
"name": "<string>",
"company": "<string>",
"mustChangePassword": true,
"totpEnabled": true,
"lastLoginAt": "2023-11-07T05:31:56Z",
"createdAt": "2023-11-07T05:31:56Z"
},
"revoked": {
"apiKeys": 123,
"passkeys": 123
}
}
}
Authorizations
Browser session cookie minted by POST /auth/login (or passkey
login). httpOnly, SameSite=Lax, 24 h TTL. Endpoints marked
Session-only accept only this credential and return
403 session_required for API keys.
Body
application/json