Skip to main content

SetUserPassword

POST 
/v1/users/:user_id/password

SetUserPassword sets another user's password and signs them out everywhere. It replaced better-auth's admin set-user-password endpoint. The new hash, the session revocation and the audit row commit together, or nothing commits. API keys are left alone.

Only a signed-in super_admin may call it, and the handler decides, as on GrantSuperAdmin: the session must hold the admin scope (which needs the platform_admin binding as well as the role), and authn.user.role must be super_admin, read in the same transaction as the write. There is no users.edit leg, so a user_admin or an org admin is refused, and an API key is refused even when its owner is a super_admin.

INVALID_ARGUMENT: user_id is empty, or the password is shorter than 8 or longer than 128 characters. FAILED_PRECONDITION: the target is the caller (use ChangePassword), is deleted, or has no password account (an SSO-only user). NOT_FOUND for an unknown user_id.

Request​

Responses​

Success