auth.security

One method, and the smallest namespace in the SDK — but the distinction it draws matters more than its size.

changePassword

changePassword({ password, new_password, nonce }) → null

Replaces the password of the currently signed-in user.

await nulvless.auth.security.changePassword({
  password: currentPassword,
  new_password: newPassword,
});

passwordstringRequired

The current password.

new_passwordstringRequired

Checked against the environment's length, character and breach rules — the same ones sign-up applies. A rejected password answers 400 password_weak.

noncestringOptional

Sudo confirmation for this one call.

Why the current password, when they are already signed in

A session proves who signed in. It does not prove who is at the keyboard now — an unlocked laptop is a signed-in session in someone else's hands. Requiring the old password makes a password change something only the account owner can do, not merely something a borrowed session can do.

Requires sudo

On top of that, the environment can put this behind manage_passwords. Two independent checks, for the same reason.

Sign out the other sessions

Changing a password does not end sessions elsewhere. If the reason for the change was a suspected compromise, the compromised session survives it — so pair the two:

await nulvless.auth.security.changePassword({ password, new_password });
await nulvless.auth.signOut('others');

'others' keeps the user signed in where they are and evicts everywhere else. signOut covers the scopes.

Forgotten passwords

A user who cannot sign in cannot call this — there is no session and no current password to supply. That path lives on the top-level client and works by proving control of the address instead:

await nulvless.auth.recover({ email });
await nulvless.auth.resetPassword({ token, password });

recover resolves the same way whether or not the address is registered, so your copy should say "if that address is registered, we sent a link" rather than confirming anything. See auth.

auth

recover, resetPassword and signOut.

Sudo mode

What the nonce is, and where it comes from.