---
title: "Service: /members/resetpassword [POST]"
source: https://dev.pageseeder.com/api/services/reset-password-POST.html
description: "POST endpoint for resetting user passwords in two steps: initial email request with token, then confirmation with token and new password. Public access, supports async email notification."
last_updated: 2026-09-02T11:36:05+10:00
document_type: api_endpoint
operation_id: member-POST
resource_id: member
path_template: /members/resetpassword
http_method: POST
api_category: member
implementation_version: 6.2004
api_since: 5.1000
deprecated_since: null
obsolete_since: null
api_support: supported
cache_control: N/A
generated_at: 2026-09-02
tokens: ~776
---

# /members/resetpassword \[POST\]

## Description

Reset password as normal user.

Resets the [password](../../reference/glossary/password.md) for the user if all parameters are correct.

### Workflow

To identify the member, either the member-username or member-email address is required.

The reset password is done in two steps:

1. The system sends an email asking for confirmation of reset password (with a token) to the user.
2. The user then confirms the request by sending the token to the system. If everything matches, a new password is set and a notification email sent to the user to confirm the password update.

This service can be used for both steps.

- If no token is specified, this service sends one by email to the member.
- Otherwise, when the request includes a  token parameter, this service attempts to update the password as specified in the member-password parameter.

### Email templates

This service uses the default PageSeeder templates.

To use customized emails, use the `globalTemplate` [global property](../../guide/configuration/properties/global_properties.md) or use the following service instead:  

 [Service: /groups/\{group\}/members/resetpassword \[POST\]](reset-password-group-POST.md).

## Parameters

| Name | Description | Required | Type | Default value |
| --- | --- | --- | --- | --- |
| email | The member’s email address | yes, if no username | email |  |
| key | The reset password key – **Obsolete** as of v6, use `token` instead | no | string |  |
| member-password | The member’s new password (empty value not supported as of v6 use [Service: /members/\{member\} \[GET\]](member-GET.md) with `token` instead) | no | string |  |
| member-username | The member’s username | yes, if no email | string |  |
| token | The reset password token | no | string |  |
| notify-async | Whether emails should be sent asynchronously (for slow email servers) | no | boolean | `false` |

## Permission

This service is public – anybody can invoke it.

## Response

When no token is specified and member-password not specified, then an email confirming the reset password request is sent to the member (step 1) and the XML output is:

```xml

<reset-password status="request-successful" />
```

If member-password is specified and the member has the correct confirmation token, then the new password is set, notification is emailed to the member and the XML output is:

```xml

<reset-password status="password-changed" />
```

When the user was not found, then the XML output is the same as the first step (so that an external user does not know if a username/email exists in the system):

```xml

<reset-password status="request-successful" />
```

## Error Handling

| Code | Cause / Description |
| --- | --- |
| 0x1008 | If the email and username are empty (for admins only) |
| 0x1002 | If the email address is invalid |
| 0x100E | If no member was found (for admins only) |
| 0x1018 | If the member is an API account |
| 0x1019 | If the account is locked |
| 0x100F | If the member has no email address |
| 0x102A | If the reset password token is invalid |