Finish Password Reset

Updated 10 September 2026

POST `?action=reset_customer_password`

Finish a password reset: spend the token and set the new password. Expired, used and unknown tokens all answer the same 422, so a token cannot be probed for. Returns the account snapshot — proving the link and choosing a password is a sign-in, so send them into the account rather than back to a login form.

Request Parameters

Field	Type	Required	Description
`reset_token`	string	Required	From the link (or from request_password_reset)
`password`	string	Required	The new password (min 8)

Response Fields

Field	Type	Description
`…`		The account snapshot — see verify_customer_login

Example request

$ch = curl_init('PANELR_API_URL?action=reset_customer_password');
curl_setopt_array($ch, [
    CURLOPT_RETURNTRANSFER => true,
    CURLOPT_POST           => true,
    CURLOPT_POSTFIELDS     => '{"reset_token":"3f9c\u2026","password":"new-password-123"}',
    CURLOPT_HTTPHEADER => [
        'X-Panelr-API-Key: YOUR_API_KEY',
        'Content-Type: application/json',
    ],
]);
$data = json_decode(curl_exec($ch), true);
curl_close($ch);

curl -X POST "PANELR_API_URL?action=reset_customer_password" \
  -H "X-Panelr-API-Key: YOUR_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{"reset_token":"3f9c\u2026","password":"new-password-123"}'

const res = await fetch('PANELR_API_URL?action=reset_customer_password', {
  method: 'POST',
  headers: {
    'X-Panelr-API-Key': 'YOUR_API_KEY',
    'Content-Type': 'application/json',
  },
  body: JSON.stringify({"reset_token":"3f9c\u2026","password":"new-password-123"}),
});
const { data } = await res.json();

import requests
r = requests.post('PANELR_API_URL',
    params={'action': 'reset_customer_password'},
    headers={'X-Panelr-API-Key': 'YOUR_API_KEY'},
    json={"reset_token":"3f9c\u2026","password":"new-password-123"})
data = r.json()['data']

POST ?action=reset_customer_password

Request Parameters

Response Fields

POST `?action=reset_customer_password`