Customers
Change the password
POST
tenantKeybearerAuthheader
X-Tenant-Key<token>The public store key (pk_live_…). Required on every call.
header
AuthorizationBearer <token>A customer token from POST /v1/auth/login, or a merchant API key, on routes that need one.
X-Client-IP?stringOptional. IP address of the shopper (one IPv4/IPv6, no port, no list). Honoured only together with a valid X-Tenant-Secret; ignored otherwise. Used for rate limits and recorded with form submissions.
X-Tenant-Secret?stringOptional here. Server secret of the store: server-to-server only, never from a browser. Enables X-Client-IP.
application/json- body
POST auth/password {current_password, password, password_confirmation}.
Same strength rule as RegisterRequest/ResetPasswordRequest (min:8, confirmed); the new
password must differ from the current one.
current_password*stringpassword*stringLength
8 <= lengthpassword_confirmation*stringLength
8 <= lengthapplication/json- response
data*curl -X POST 'https://api.elaraone.app/api/v1/auth/password' \ -H 'X-Tenant-Key: pk_live_…' \ -H 'X-Tenant-Secret: your-server-secret' \ -H 'Content-Type: application/json' \ -d '{ "current_password": "string", "password": "stringst", "password_confirmation": "stringst"}'Example Response
{ "data": { "status": "password-changed", "revoked_tokens": 0 }}