> ## Documentation Index
> Fetch the complete documentation index at: https://docs.contafy.com.mx/llms.txt
> Use this file to discover all available pages before exploring further.

# Reset Password

> Reset a user password using a reset token

Resets a user's password using the token sent to their email via the forgot password endpoint. This completes the password recovery process.

## Authentication

No authentication required.

## Request Body

<ParamField body="token" type="string" required>
  Password reset token sent to the user's email address. This token is typically included in the password reset link.
</ParamField>

<ParamField body="password" type="string" required>
  New password for the account. Should meet security requirements (minimum 8 characters recommended).
</ParamField>

## Response

<ResponseField name="message" type="string">
  Success message confirming the password has been reset.
</ResponseField>

## Example Request

```bash theme={null}
curl -X POST https://api.contafy.com/api/auth/reset-password \
  -H "Content-Type: application/json" \
  -d '{
    "token": "prt_x1y2z3a4b5c6d7e8f9g0h1i2j3k4l5m6",
    "password": "NewSecurePass123!"
  }'
```

## Example Response

```json theme={null}
{
  "message": "Contraseña restablecida exitosamente"
}
```

## Error Responses

<ResponseField name="error" type="string">
  Error type identifier.
</ResponseField>

<ResponseField name="message" type="string">
  Human-readable error message.
</ResponseField>

### Common Errors

**400 Bad Request**

```json theme={null}
{
  "error": "INVALID_TOKEN",
  "message": "El token de restablecimiento es inválido o ha expirado"
}
```

**400 Bad Request**

```json theme={null}
{
  "error": "VALIDATION_ERROR",
  "message": "Token y contraseña son requeridos"
}
```

**400 Bad Request**

```json theme={null}
{
  "error": "VALIDATION_ERROR",
  "message": "La contraseña debe tener al menos 8 caracteres"
}
```

## Notes

* Password reset tokens typically expire after 1 hour
* Once a token is used successfully, it becomes invalid
* After resetting the password, users should log in with their new credentials
* For security, all active sessions are terminated when the password is reset
* The new password cannot be the same as the old password