POST /api/auth/set-new-password

Reset a user’s password using a valid OTP.

This endpoint resets a user’s password after verifying a valid OTP.

It completes the password reset flow initiated by the forgot password endpoint.

When to use

HTTP

POST /api/auth/set-new-password
Content-Type: application/json

Request Body

{
  "email": "user@example.com",
  "otp": "123456",
  "newPassword": "new-strong-password"
}

Field	Type	Required	Description
email	string	Yes	Registered user email
otp	string	Yes	Password reset OTP
newPassword	string	Yes	New user password

Response

{
  "success": true
}

The user can now log in using the new password.

Error

{
  "success": false,
  "message": "Invalid or expired OTP"
}

Error

{
  "success": false,
  "message": "Invalid request"
}

Error

{
  "success": false,
  "message": "Too many attempts"
}