> ## Documentation Index
> Fetch the complete documentation index at: https://docs.sagescreen.dev/llms.txt
> Use this file to discover all available pages before exploring further.

# Set a new password using a reset key

> Completes the password-reset flow. The `reset_key` and `login`
are validated via `check_password_reset_key()`. On success the
password is updated and a confirmation email is sent.

Registered as `wp_ajax_nopriv_sagescreen_reset_password` — **public**.




## OpenAPI

````yaml /openapi/private/specs/wp/auth.yml post /wp-admin/admin-ajax.php?action=sagescreen_reset_password
openapi: 3.1.0
info:
  title: SageScreen — Auth Module
  description: >
    Authentication and session management. Handles JWT token lifecycle

    (issue, refresh, validate, revoke) and WordPress-based login/logout

    with reCAPTCHA/Turnstile protection.


    Uses RS256-signed JWTs stored in the `wp_sage_screen_jwt` table.

    Tokens have a configurable TTL (`sage_screen_jwt_expires`, default 3600 s)

    and a separate refresh window (`sage_screen_jwt_refresh_expires`, default
    604800 s / 7 days).
  version: 1.0.0
servers:
  - url: https://{domain}/wp-json/sagescreen/v1
    description: WordPress REST API
    variables:
      domain:
        default: api.sagescreen.app
security: []
tags:
  - name: Auth – REST
    description: JWT token endpoints (REST API)
  - name: Auth – AJAX
    description: Session-based login / logout / password flows (AJAX)
paths:
  /wp-admin/admin-ajax.php?action=sagescreen_reset_password:
    post:
      tags:
        - Auth – AJAX
      summary: Set a new password using a reset key
      description: |
        Completes the password-reset flow. The `reset_key` and `login`
        are validated via `check_password_reset_key()`. On success the
        password is updated and a confirmation email is sent.

        Registered as `wp_ajax_nopriv_sagescreen_reset_password` — **public**.
      operationId: ajaxResetPassword
      requestBody:
        required: true
        content:
          application/x-www-form-urlencoded:
            schema:
              $ref: '#/components/schemas/AjaxResetPasswordRequest'
      responses:
        '200':
          description: Password reset result
          content:
            application/json:
              schema:
                oneOf:
                  - $ref: '#/components/schemas/AjaxSuccessMessage'
                  - $ref: '#/components/schemas/AjaxErrorResponse'
              examples:
                success:
                  summary: Password changed
                  value:
                    success: true
                    data:
                      message: Password reset successfully
                nonceFail:
                  summary: Nonce check failed
                  value:
                    success: false
                    data: Security check failed
                recaptchaFail:
                  summary: reCAPTCHA failed
                  value:
                    success: false
                    data: Security verification failed. Please try again.
                missingFields:
                  summary: Required fields missing
                  value:
                    success: false
                    data: All fields are required
                mismatch:
                  summary: Passwords don't match
                  value:
                    success: false
                    data: Passwords do not match
                tooShort:
                  summary: Password too short
                  value:
                    success: false
                    data: Password must be at least 8 characters
                invalidKey:
                  summary: Reset key invalid or expired
                  value:
                    success: false
                    data: This password reset link is invalid or has expired
      security: []
components:
  schemas:
    AjaxResetPasswordRequest:
      type: object
      required:
        - action
        - reset_password_nonce
        - recaptcha_token
        - reset_key
        - login
        - new_password
        - confirm_password
      properties:
        action:
          type: string
          const: sagescreen_reset_password
        reset_password_nonce:
          type: string
          description: WP nonce for `sagescreen_reset_password`
        recaptcha_token:
          type: string
          description: Turnstile / reCAPTCHA token (action `reset_password`)
        reset_key:
          type: string
          description: Password reset key from the email link
          examples:
            - abc123def456
        login:
          type: string
          description: Username or email address
          examples:
            - john.doe
        new_password:
          type: string
          format: password
          minLength: 8
          examples:
            - NewSecurePass456
        confirm_password:
          type: string
          format: password
          description: Must match `new_password`
          examples:
            - NewSecurePass456
    AjaxSuccessMessage:
      type: object
      properties:
        success:
          type: boolean
          const: true
        data:
          type: object
          required:
            - message
          properties:
            message:
              type: string
              examples:
                - Password reset successfully
    AjaxErrorResponse:
      type: object
      description: |
        Standard AJAX error. The `data` field is either a plain string
        or an object with additional context (e.g. `no_council: true`).
      properties:
        success:
          type: boolean
          const: false
        data:
          oneOf:
            - type: string
              examples:
                - Security check failed
            - type: object
              properties:
                message:
                  type: string
                no_council:
                  type: boolean

````