Authentication

Change or set a password

Change the password of the signed-in shopper, or set one for an account that has none. Every other session of the account ends; the response carries a new session for the caller. The account is also sent a notice that its password changed.

current_password is required when the account has a password (user.has_password is true) and is checked first; a wrong one answers 401 invalid_credentials and counts toward the account’s lock. An account created for sign-in by emailed code has no password, so it omits current_password. The new password follows the password rule of POST /v1/auth/register; a password that breaks it is refused with 400 weak_password.

Secret key required. This endpoint requires a secret key (tybrite_sk_*). Publishable keys answer 403 forbidden. Account calls are made from a server, which then holds the shopper’s session.

Attempt limits: 5 password changes per sign-in token per 15 minutes. Beyond that the call returns 429 rate_limited with a Retry-After header.

POST

auth

password

change

Change or set a password

curl --request POST \
  --url https://api.tybritelabs.com/v1/auth/password/change \
  --header 'Authorization: Bearer <token>' \
  --header 'Content-Type: application/json' \
  --header 'x-auth-token: <x-auth-token>' \
  --data '
{
  "current_password": "SecurePassword123!",
  "new_password": "NewSecurePassword456!"
}
'

import requests

url = "https://api.tybritelabs.com/v1/auth/password/change"

payload = {
    "current_password": "SecurePassword123!",
    "new_password": "NewSecurePassword456!"
}
headers = {
    "x-auth-token": "<x-auth-token>",
    "Authorization": "Bearer <token>",
    "Content-Type": "application/json"
}

response = requests.post(url, json=payload, headers=headers)

print(response.text)

const options = {
  method: 'POST',
  headers: {
    'x-auth-token': '<x-auth-token>',
    Authorization: 'Bearer <token>',
    'Content-Type': 'application/json'
  },
  body: JSON.stringify({current_password: 'SecurePassword123!', new_password: 'NewSecurePassword456!'})
};

fetch('https://api.tybritelabs.com/v1/auth/password/change', options)
  .then(res => res.json())
  .then(res => console.log(res))
  .catch(err => console.error(err));

<?php

$curl = curl_init();

curl_setopt_array($curl, [
  CURLOPT_URL => "https://api.tybritelabs.com/v1/auth/password/change",
  CURLOPT_RETURNTRANSFER => true,
  CURLOPT_ENCODING => "",
  CURLOPT_MAXREDIRS => 10,
  CURLOPT_TIMEOUT => 30,
  CURLOPT_HTTP_VERSION => CURL_HTTP_VERSION_1_1,
  CURLOPT_CUSTOMREQUEST => "POST",
  CURLOPT_POSTFIELDS => json_encode([
    'current_password' => 'SecurePassword123!',
    'new_password' => 'NewSecurePassword456!'
  ]),
  CURLOPT_HTTPHEADER => [
    "Authorization: Bearer <token>",
    "Content-Type: application/json",
    "x-auth-token: <x-auth-token>"
  ],
]);

$response = curl_exec($curl);
$err = curl_error($curl);

curl_close($curl);

if ($err) {
  echo "cURL Error #:" . $err;
} else {
  echo $response;
}

package main

import (
	"fmt"
	"strings"
	"net/http"
	"io"
)

func main() {

	url := "https://api.tybritelabs.com/v1/auth/password/change"

	payload := strings.NewReader("{\n  \"current_password\": \"SecurePassword123!\",\n  \"new_password\": \"NewSecurePassword456!\"\n}")

	req, _ := http.NewRequest("POST", url, payload)

	req.Header.Add("x-auth-token", "<x-auth-token>")
	req.Header.Add("Authorization", "Bearer <token>")
	req.Header.Add("Content-Type", "application/json")

	res, _ := http.DefaultClient.Do(req)

	defer res.Body.Close()
	body, _ := io.ReadAll(res.Body)

	fmt.Println(string(body))

}

HttpResponse<String> response = Unirest.post("https://api.tybritelabs.com/v1/auth/password/change")
  .header("x-auth-token", "<x-auth-token>")
  .header("Authorization", "Bearer <token>")
  .header("Content-Type", "application/json")
  .body("{\n  \"current_password\": \"SecurePassword123!\",\n  \"new_password\": \"NewSecurePassword456!\"\n}")
  .asString();

require 'uri'
require 'net/http'

url = URI("https://api.tybritelabs.com/v1/auth/password/change")

http = Net::HTTP.new(url.host, url.port)
http.use_ssl = true

request = Net::HTTP::Post.new(url)
request["x-auth-token"] = '<x-auth-token>'
request["Authorization"] = 'Bearer <token>'
request["Content-Type"] = 'application/json'
request.body = "{\n  \"current_password\": \"SecurePassword123!\",\n  \"new_password\": \"NewSecurePassword456!\"\n}"

response = http.request(request)
puts response.read_body

{
  "message": "Password updated",
  "user": {
    "id": "633e7cb6-00c6-4aac-b03c-c3d70d64e25c",
    "email": "john.doe@example.com",
    "email_confirmed": true,
    "email_verified": true,
    "has_password": true
  },
  "session": {
    "access_token": "eyJhbGciOiJFUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiI2MzNlN2NiNiJ9.<redacted-signature>",
    "refresh_token": "gcsr_Zm9vYmFyYmF6cXV4MTIzNDU2Nzg5MGFiY2RlZmdoaWo",
    "expires_in": 900,
    "expires_at": 1781967759,
    "token_type": "shopper"
  }
}

Authorizations

Authorization

string

header

required

API Key Authentication

Use your API key in the Authorization header:

Authorization: Bearer tybrite_sk_live_YOUR_KEY

Key Types:

Secret Keys (Server-Side Only):

Format: tybrite_sk_live_* (production) or tybrite_sk_test_* (sandbox)
Full read/write access to all endpoints
⚠️ NEVER expose in client-side code or public repositories
Required for: every write a shopper does not make for themselves, authentication, payment verification, AI recommendations

Publishable Keys (Client-Safe):

Format: tybrite_pk_live_* (production) or tybrite_pk_test_* (sandbox)
Catalogue reads, plus the actions a shopper takes for themselves
✅ Safe for client-side JavaScript, mobile apps, and public code
Allowed for: browsing products, search, CMS content, pricing queries, cart and wishlist, reviews, storefront events, and the Agent API's quotes, cart drafts and checkout intents

Endpoint-Specific Requirements:

Authentication endpoints (/v1/auth/*): Secret key required
Payment verification (POST /v1/payments/verify): Secret key required
AI Recommendations (POST /v1/recommendations): Secret key required
Semantic Search (POST /v1/search): Both key types allowed (read-only operation)
Shopper actions (cart, wishlist, reviews, storefront events, Agent API quotes, cart drafts and checkout intents): Both key types allowed
All other write operations: Secret key required
All read operations: Both key types allowed

Using a publishable key for restricted operations returns 403 Forbidden.

Headers

x-auth-token

string

required

The store's sign-in token, the access_token of the shopper's session. A token that is expired, revoked, issued by another store or environment, or malformed answers 401 invalid_token.

Example:

"eyJhbGciOiJFUzI1NiIsInR5cCI6IkpXVCJ9..."

Body

application/json

new_password

string

required

New password, 8 to 72 characters, not on the list of commonly used passwords.

Required string length: 8 - 72

Example:

"NewSecurePassword456!"

current_password

string

The password in use. Required when the account has a password.

Example:

"SecurePassword123!"

Response

Password updated.

message

string

required

Example:

"Password updated"

user

object

required

The shopper's sign-in identity.

Show child attributes

session

object

required

A shopper's session with the store: a short-lived sign-in token and a refresh token. Store both values and replace them on every refresh.

Show child attributes

Change or set a password

curl --request POST \
  --url https://api.tybritelabs.com/v1/auth/password/change \
  --header 'Authorization: Bearer <token>' \
  --header 'Content-Type: application/json' \
  --header 'x-auth-token: <x-auth-token>' \
  --data '
{
  "current_password": "SecurePassword123!",
  "new_password": "NewSecurePassword456!"
}
'

import requests

url = "https://api.tybritelabs.com/v1/auth/password/change"

payload = {
    "current_password": "SecurePassword123!",
    "new_password": "NewSecurePassword456!"
}
headers = {
    "x-auth-token": "<x-auth-token>",
    "Authorization": "Bearer <token>",
    "Content-Type": "application/json"
}

response = requests.post(url, json=payload, headers=headers)

print(response.text)

const options = {
  method: 'POST',
  headers: {
    'x-auth-token': '<x-auth-token>',
    Authorization: 'Bearer <token>',
    'Content-Type': 'application/json'
  },
  body: JSON.stringify({current_password: 'SecurePassword123!', new_password: 'NewSecurePassword456!'})
};

fetch('https://api.tybritelabs.com/v1/auth/password/change', options)
  .then(res => res.json())
  .then(res => console.log(res))
  .catch(err => console.error(err));

<?php

$curl = curl_init();

curl_setopt_array($curl, [
  CURLOPT_URL => "https://api.tybritelabs.com/v1/auth/password/change",
  CURLOPT_RETURNTRANSFER => true,
  CURLOPT_ENCODING => "",
  CURLOPT_MAXREDIRS => 10,
  CURLOPT_TIMEOUT => 30,
  CURLOPT_HTTP_VERSION => CURL_HTTP_VERSION_1_1,
  CURLOPT_CUSTOMREQUEST => "POST",
  CURLOPT_POSTFIELDS => json_encode([
    'current_password' => 'SecurePassword123!',
    'new_password' => 'NewSecurePassword456!'
  ]),
  CURLOPT_HTTPHEADER => [
    "Authorization: Bearer <token>",
    "Content-Type: application/json",
    "x-auth-token: <x-auth-token>"
  ],
]);

$response = curl_exec($curl);
$err = curl_error($curl);

curl_close($curl);

if ($err) {
  echo "cURL Error #:" . $err;
} else {
  echo $response;
}

package main

import (
	"fmt"
	"strings"
	"net/http"
	"io"
)

func main() {

	url := "https://api.tybritelabs.com/v1/auth/password/change"

	payload := strings.NewReader("{\n  \"current_password\": \"SecurePassword123!\",\n  \"new_password\": \"NewSecurePassword456!\"\n}")

	req, _ := http.NewRequest("POST", url, payload)

	req.Header.Add("x-auth-token", "<x-auth-token>")
	req.Header.Add("Authorization", "Bearer <token>")
	req.Header.Add("Content-Type", "application/json")

	res, _ := http.DefaultClient.Do(req)

	defer res.Body.Close()
	body, _ := io.ReadAll(res.Body)

	fmt.Println(string(body))

}

HttpResponse<String> response = Unirest.post("https://api.tybritelabs.com/v1/auth/password/change")
  .header("x-auth-token", "<x-auth-token>")
  .header("Authorization", "Bearer <token>")
  .header("Content-Type", "application/json")
  .body("{\n  \"current_password\": \"SecurePassword123!\",\n  \"new_password\": \"NewSecurePassword456!\"\n}")
  .asString();

require 'uri'
require 'net/http'

url = URI("https://api.tybritelabs.com/v1/auth/password/change")

http = Net::HTTP.new(url.host, url.port)
http.use_ssl = true

request = Net::HTTP::Post.new(url)
request["x-auth-token"] = '<x-auth-token>'
request["Authorization"] = 'Bearer <token>'
request["Content-Type"] = 'application/json'
request.body = "{\n  \"current_password\": \"SecurePassword123!\",\n  \"new_password\": \"NewSecurePassword456!\"\n}"

response = http.request(request)
puts response.read_body

{
  "message": "Password updated",
  "user": {
    "id": "633e7cb6-00c6-4aac-b03c-c3d70d64e25c",
    "email": "john.doe@example.com",
    "email_confirmed": true,
    "email_verified": true,
    "has_password": true
  },
  "session": {
    "access_token": "eyJhbGciOiJFUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiI2MzNlN2NiNiJ9.<redacted-signature>",
    "refresh_token": "gcsr_Zm9vYmFyYmF6cXV4MTIzNDU2Nzg5MGFiY2RlZmdoaWo",
    "expires_in": 900,
    "expires_at": 1781967759,
    "token_type": "shopper"
  }
}

Reference

System

Store

Products

Taxonomy

Orders

Payments

Cart & Wishlist

Marketplace

Recommendations

Discovery

Events

Tax

Analytics

Agent

Search

Authentication

Customers

Gift Cards

Promotions

Campaigns

CMS

Pricing

Messaging

Shipping

GC Connect

Reviews

Returns

Disputes

B2B

Webhooks

Ingestion

Feeds

Sandbox

Change or set a password

Authorizations

Headers

Body

Response