Change password

Live

POST/api/v1/auth/change-password

A logged-in member changes their own password — verify the current password, set the new one. The current session stays valid; no re-login needed.

On success the current session keeps working (nothing is revoked)

Headers

Field	Type	Required	Description
Authorization	string	Yes	Used — send Bearer <member access_token>
X-Api-Key	string	Yes	Agent API key (ak_…) from the bo screen
X-Timestamp	string	Yes	Signing time in unix milliseconds (±300s skew allowed)
X-Nonce	string	Yes	Unique per-request value (UUIDv4) for replay protection
X-Signature	string	Yes	hex(HMAC-SHA256(secret, canonical)) — see the Authentication page
X-Player-IP	string	—	The player's real IP (IPv4/IPv6) — recommended (used in login history)
X-Player-UA	string	—	The player's User-Agent (optional — recorded in login history)
X-Request-Id	string	—	Your correlation id — echoed back as request_uuid (recommended)
x-lang	string	—	th (default) or en — the language of message

Request bodyapplication/json

Field	Type	Required	Description
current_password	string	Yes	The current password — always verified against the stored hash first; mismatch → 1005
new_password	string	Yes	The new password, 6-72 characters (same rules as register)

Request example

{
  "current_password": "P@ssw0rd123",
  "new_password": "N3wP@ssw0rd"
}

Response

Fields in data

Field	Type	Required	Description
changed	boolean	—	true = the password is changed — the next login uses the new password; the current session/tokens keep working

Response example

{
  "success": true,
  "code": 0,
  "message": "สำเร็จ",
  "data": {
    "changed": true
  },
  "request_uuid": "5b8d2f91-3c47-4e60-a1d9-7f2e8c4b0a53"
}

Possible error codes

code	Name	HTTP	Message
1001	UNAUTHORIZED	401	UnauthorizedMissing Authorization: Bearer header
1007	TOKEN_INVALID	401	Token invalidInvalid/expired access token, or the session was revoked (logout)
1005	INVALID_CREDENTIALS	401	Invalid credentialscurrent_password does not match the member's current password
1002	FORBIDDEN	403	ForbiddenThe session is a read-only impersonation session — the password cannot be changed
4001	VALIDATION_ERROR	400	Validation errornew_password is shorter than 6 or longer than 72 characters
9003	TOO_MANY_REQUESTS	429	Too many requests. Please slow downAuth-group rate limit exceeded (10 req/min/IP)