Reset a password
Set a new password with the code from the reset email, or with the link_token the email’s link
carries. Every earlier session of the account ends, and the response is a new session. A link needs
no email. The account is also sent a notice that its password changed.
A code is valid for 15 minutes, is accepted 5 times and works once. A wrong, expired or used code
answers 400 invalid_code with no reason. The new password follows the password rule of
POST /v1/auth/register; a password that breaks it is refused with 400 weak_password. The reset
also clears a password_reset_required state.
Secret key required. This endpoint requires a secret key (tybrite_sk_*). Publishable keys
answer 403 forbidden. Account calls are made from a server, which then holds the shopper’s session.
Attempt limits: with a secret key, past 10 attempts for one email address from one store in
15 minutes, the call is slowed to one attempt every 30 seconds; other calls for that address
answer 429 rate_limited with a Retry-After header giving the seconds until the next attempt is
accepted. With a publishable key, attempts are limited per calling address: 20 per address and email,
and 60 per address, in 15 minutes. Across every store and address, past 20 attempts for one
email the call is slowed to one every 30 seconds. Every attempt counts, successful or not,
and an address with no account is treated identically.
curl --request POST \
--url https://api.tybritelabs.com/v1/auth/password/reset \
--header 'Authorization: Bearer <token>' \
--header 'Content-Type: application/json' \
--data '
{
"email": "john.doe@example.com",
"code": "123456",
"new_password": "NewSecurePassword456!"
}
'import requests
url = "https://api.tybritelabs.com/v1/auth/password/reset"
payload = {
"email": "john.doe@example.com",
"code": "123456",
"new_password": "NewSecurePassword456!"
}
headers = {
"Authorization": "Bearer <token>",
"Content-Type": "application/json"
}
response = requests.post(url, json=payload, headers=headers)
print(response.text)const options = {
method: 'POST',
headers: {Authorization: 'Bearer <token>', 'Content-Type': 'application/json'},
body: JSON.stringify({
email: 'john.doe@example.com',
code: '123456',
new_password: 'NewSecurePassword456!'
})
};
fetch('https://api.tybritelabs.com/v1/auth/password/reset', options)
.then(res => res.json())
.then(res => console.log(res))
.catch(err => console.error(err));<?php
$curl = curl_init();
curl_setopt_array($curl, [
CURLOPT_URL => "https://api.tybritelabs.com/v1/auth/password/reset",
CURLOPT_RETURNTRANSFER => true,
CURLOPT_ENCODING => "",
CURLOPT_MAXREDIRS => 10,
CURLOPT_TIMEOUT => 30,
CURLOPT_HTTP_VERSION => CURL_HTTP_VERSION_1_1,
CURLOPT_CUSTOMREQUEST => "POST",
CURLOPT_POSTFIELDS => json_encode([
'email' => 'john.doe@example.com',
'code' => '123456',
'new_password' => 'NewSecurePassword456!'
]),
CURLOPT_HTTPHEADER => [
"Authorization: Bearer <token>",
"Content-Type: application/json"
],
]);
$response = curl_exec($curl);
$err = curl_error($curl);
curl_close($curl);
if ($err) {
echo "cURL Error #:" . $err;
} else {
echo $response;
}package main
import (
"fmt"
"strings"
"net/http"
"io"
)
func main() {
url := "https://api.tybritelabs.com/v1/auth/password/reset"
payload := strings.NewReader("{\n \"email\": \"john.doe@example.com\",\n \"code\": \"123456\",\n \"new_password\": \"NewSecurePassword456!\"\n}")
req, _ := http.NewRequest("POST", url, payload)
req.Header.Add("Authorization", "Bearer <token>")
req.Header.Add("Content-Type", "application/json")
res, _ := http.DefaultClient.Do(req)
defer res.Body.Close()
body, _ := io.ReadAll(res.Body)
fmt.Println(string(body))
}HttpResponse<String> response = Unirest.post("https://api.tybritelabs.com/v1/auth/password/reset")
.header("Authorization", "Bearer <token>")
.header("Content-Type", "application/json")
.body("{\n \"email\": \"john.doe@example.com\",\n \"code\": \"123456\",\n \"new_password\": \"NewSecurePassword456!\"\n}")
.asString();require 'uri'
require 'net/http'
url = URI("https://api.tybritelabs.com/v1/auth/password/reset")
http = Net::HTTP.new(url.host, url.port)
http.use_ssl = true
request = Net::HTTP::Post.new(url)
request["Authorization"] = 'Bearer <token>'
request["Content-Type"] = 'application/json'
request.body = "{\n \"email\": \"john.doe@example.com\",\n \"code\": \"123456\",\n \"new_password\": \"NewSecurePassword456!\"\n}"
response = http.request(request)
puts response.read_body{
"message": "Password reset",
"user": {
"id": "633e7cb6-00c6-4aac-b03c-c3d70d64e25c",
"email": "john.doe@example.com",
"email_confirmed": true,
"email_verified": true,
"has_password": true
},
"customer": {
"id": "de11e44b-78e5-4940-ad54-cac237d5d30d",
"name": "John Doe",
"email": "john.doe@example.com",
"phone": "+12125550142",
"tier": "bronze",
"total_purchases": 0,
"created_at": "2026-06-20T13:47:38.831799+00:00"
},
"session": {
"access_token": "eyJhbGciOiJFUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiI2MzNlN2NiNiJ9.<redacted-signature>",
"refresh_token": "gcsr_Zm9vYmFyYmF6cXV4MTIzNDU2Nzg5MGFiY2RlZmdoaWo",
"expires_in": 900,
"expires_at": 1781967759,
"token_type": "shopper"
}
}Authorizations
API Key Authentication
Use your API key in the Authorization header:
Authorization: Bearer tybrite_sk_live_YOUR_KEY
Key Types:
Secret Keys (Server-Side Only):
- Format:
tybrite_sk_live_*(production) ortybrite_sk_test_*(sandbox) - Full read/write access to all endpoints
- ⚠️ NEVER expose in client-side code or public repositories
- Required for: every write a shopper does not make for themselves, authentication, payment verification, AI recommendations
Publishable Keys (Client-Safe):
- Format:
tybrite_pk_live_*(production) ortybrite_pk_test_*(sandbox) - Catalogue reads, plus the actions a shopper takes for themselves
- ✅ Safe for client-side JavaScript, mobile apps, and public code
- Allowed for: browsing products, search, CMS content, pricing queries, cart and wishlist, reviews, storefront events, and the Agent API's quotes, cart drafts and checkout intents
Endpoint-Specific Requirements:
- Authentication endpoints (
/v1/auth/*): Secret key required - Payment verification (
POST /v1/payments/verify): Secret key required - AI Recommendations (
POST /v1/recommendations): Secret key required - Semantic Search (
POST /v1/search): Both key types allowed (read-only operation) - Shopper actions (cart, wishlist, reviews, storefront events, Agent API quotes, cart drafts and checkout intents): Both key types allowed
- All other write operations: Secret key required
- All read operations: Both key types allowed
Using a publishable key for restricted operations returns 403 Forbidden.
Body
Send email with code, or link_token alone, together with new_password.
New password, 8 to 72 characters, not on the list of commonly used passwords.
8 - 72"NewSecurePassword456!"
Customer email address. Required with code.
"john.doe@example.com"
The six-digit code from the reset email.
^[0-9]{6}$"123456"
The link_token query parameter of the reset link. Replaces email and code.
Response
Password changed and signed in.
A successful sign-in, sign-up verification or password reset.
The shopper's sign-in identity.
Show child attributes
Show child attributes
The shopper's customer record at this store. null when the key belongs to a marketplace, where a shopper holds an account without a per-store record.
Show child attributes
Show child attributes
A shopper's session with the store: a short-lived sign-in token and a refresh token. Store both values and replace them on every refresh.
Show child attributes
Show child attributes
curl --request POST \
--url https://api.tybritelabs.com/v1/auth/password/reset \
--header 'Authorization: Bearer <token>' \
--header 'Content-Type: application/json' \
--data '
{
"email": "john.doe@example.com",
"code": "123456",
"new_password": "NewSecurePassword456!"
}
'import requests
url = "https://api.tybritelabs.com/v1/auth/password/reset"
payload = {
"email": "john.doe@example.com",
"code": "123456",
"new_password": "NewSecurePassword456!"
}
headers = {
"Authorization": "Bearer <token>",
"Content-Type": "application/json"
}
response = requests.post(url, json=payload, headers=headers)
print(response.text)const options = {
method: 'POST',
headers: {Authorization: 'Bearer <token>', 'Content-Type': 'application/json'},
body: JSON.stringify({
email: 'john.doe@example.com',
code: '123456',
new_password: 'NewSecurePassword456!'
})
};
fetch('https://api.tybritelabs.com/v1/auth/password/reset', options)
.then(res => res.json())
.then(res => console.log(res))
.catch(err => console.error(err));<?php
$curl = curl_init();
curl_setopt_array($curl, [
CURLOPT_URL => "https://api.tybritelabs.com/v1/auth/password/reset",
CURLOPT_RETURNTRANSFER => true,
CURLOPT_ENCODING => "",
CURLOPT_MAXREDIRS => 10,
CURLOPT_TIMEOUT => 30,
CURLOPT_HTTP_VERSION => CURL_HTTP_VERSION_1_1,
CURLOPT_CUSTOMREQUEST => "POST",
CURLOPT_POSTFIELDS => json_encode([
'email' => 'john.doe@example.com',
'code' => '123456',
'new_password' => 'NewSecurePassword456!'
]),
CURLOPT_HTTPHEADER => [
"Authorization: Bearer <token>",
"Content-Type: application/json"
],
]);
$response = curl_exec($curl);
$err = curl_error($curl);
curl_close($curl);
if ($err) {
echo "cURL Error #:" . $err;
} else {
echo $response;
}package main
import (
"fmt"
"strings"
"net/http"
"io"
)
func main() {
url := "https://api.tybritelabs.com/v1/auth/password/reset"
payload := strings.NewReader("{\n \"email\": \"john.doe@example.com\",\n \"code\": \"123456\",\n \"new_password\": \"NewSecurePassword456!\"\n}")
req, _ := http.NewRequest("POST", url, payload)
req.Header.Add("Authorization", "Bearer <token>")
req.Header.Add("Content-Type", "application/json")
res, _ := http.DefaultClient.Do(req)
defer res.Body.Close()
body, _ := io.ReadAll(res.Body)
fmt.Println(string(body))
}HttpResponse<String> response = Unirest.post("https://api.tybritelabs.com/v1/auth/password/reset")
.header("Authorization", "Bearer <token>")
.header("Content-Type", "application/json")
.body("{\n \"email\": \"john.doe@example.com\",\n \"code\": \"123456\",\n \"new_password\": \"NewSecurePassword456!\"\n}")
.asString();require 'uri'
require 'net/http'
url = URI("https://api.tybritelabs.com/v1/auth/password/reset")
http = Net::HTTP.new(url.host, url.port)
http.use_ssl = true
request = Net::HTTP::Post.new(url)
request["Authorization"] = 'Bearer <token>'
request["Content-Type"] = 'application/json'
request.body = "{\n \"email\": \"john.doe@example.com\",\n \"code\": \"123456\",\n \"new_password\": \"NewSecurePassword456!\"\n}"
response = http.request(request)
puts response.read_body{
"message": "Password reset",
"user": {
"id": "633e7cb6-00c6-4aac-b03c-c3d70d64e25c",
"email": "john.doe@example.com",
"email_confirmed": true,
"email_verified": true,
"has_password": true
},
"customer": {
"id": "de11e44b-78e5-4940-ad54-cac237d5d30d",
"name": "John Doe",
"email": "john.doe@example.com",
"phone": "+12125550142",
"tier": "bronze",
"total_purchases": 0,
"created_at": "2026-06-20T13:47:38.831799+00:00"
},
"session": {
"access_token": "eyJhbGciOiJFUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiI2MzNlN2NiNiJ9.<redacted-signature>",
"refresh_token": "gcsr_Zm9vYmFyYmF6cXV4MTIzNDU2Nzg5MGFiY2RlZmdoaWo",
"expires_in": 900,
"expires_at": 1781967759,
"token_type": "shopper"
}
}