Change Password

Update the authenticated user’s password

Endpoint

POST /auth/change-password · endpoint

Change the password for the currently authenticated user

Authentication

This endpoint requires authentication. Include a valid JWT token in the Authorization header.

Authorization: Bearer YOUR_JWT_TOKEN

Request Body

currentPassword · string · required

The user’s current password for verification

newPassword · string · required

The new password to set. Should meet minimum security requirements.

Response

success · boolean · required

Indicates whether the password change was successful

message · string

Human-readable message describing the result

Example Request

curl

curl -X POST https://api.invenicum.example/v1/auth/change-password \
  -H "Content-Type: application/json" \
  -H "Authorization: Bearer YOUR_JWT_TOKEN" \
  -d '{
    "currentPassword": "oldPassword123",
    "newPassword": "newSecurePassword456"
  }'

Example Response

Success Response (200 OK)

{
  "success": true,
  "message": "Password updated successfully"
}

Error Response (400 Bad Request)

{
  "success": false,
  "message": "La contraseña actual no es correcta"
}

Error Response (401 Unauthorized)

{
  "success": false,
  "message": "Authentication required"
}

Error Codes

Status Code	Description
200	Password changed successfully
400	Current password is incorrect
401	Not authenticated or invalid token
422	Validation error (e.g., weak password)
500	Internal server error

Password Requirements

While not enforced by the API shown in the source code, follow these best practices:

Password Security Guidelines

• Minimum 8 characters
• Mix of uppercase and lowercase letters
• At least one number
• At least one special character
• Should not match common passwords
• Should not contain user’s email or name

Implementation Details

The password change endpoint (from api_service.dart:60-82):

1. Validates the current password on the backend
2. If valid, updates to the new password
3. Returns success status or error message
4. Error messages can be in message or error fields

After changing the password, the user’s current session remains valid. The JWT token is not invalidated, so the user can continue using the application without re-logging in.

Common Errors

Current password is incorrect

The currentPassword field does not match the user’s actual password. The error message may be in Spanish: “La contraseña actual no es correcta”.

Solution: Verify the user is entering their correct current password.

Token expired or invalid

The JWT token in the Authorization header is missing, malformed, or expired.

Solution: Redirect the user to the login page to obtain a fresh token.

Connection error

Network connectivity issues or backend unavailability.

Solution: Display a user-friendly error message and allow retry. The error is caught as “Error de conexión al cambiar contraseña”.

Security Notes

• Always use HTTPS in production to protect credentials in transit
• The current password is verified before allowing changes
• Consider implementing rate limiting to prevent brute force attacks
• Log password change events for security auditing
• Consider requiring re-authentication after password change for sensitive accounts

Related Endpoints

• Login - Authenticate and obtain token