> For the complete Lynkow documentation index in agent-friendly format, see [llms.txt](/llms.txt).

# Confirm a storefront customer password reset

**Publié le** : 2026-08-19
**Catégorie** : Commerce

## `POST /customers/password-reset/confirm`

**Confirm a storefront customer password reset**

Consumes a single-use reset token (hashed at rest, constant-time compared, TTL and
`used_at` checked in the service), sets the new scrypt password hash, marks the
inbox as verified (`email_verified = true`, completing a claimed account), and
bumps `customers.token_invalidated_at` so any leaked pre-reset session is revoked.
The password/verification flags and token consumption commit atomically. Only a row
that ALREADY has a password may be reset: a token presented for a passwordless row is
rejected with the same uniform 400 as an invalid link. An invalid,
expired, or already-used token returns a uniform 400 (no oracle). Behind the
publishable key, the `customer_accounts` flag, and the customer-auth rate-limit
bucket. Returns 200 with `{ ok: true }`.

> **Note:** This endpoint requires the e-commerce feature to be enabled on your site.

### Request Body

Content-Type: `application/json`

| Field | Type | Required | Description |
| --- | --- | --- | --- |
| `token` | string | Yes | Required. Min 1 character |
| `password` | string | Yes | Required. 8-100 characters |


### Responses

| Status | Description |
| --- | --- |
| `200` | Successful response |
| `401` | Missing or invalid storefront publishable key |
| `402` | The site subscription does not currently permit this operation |
| `403` | The storefront key origin is not allowed |
| `404` | Site, resource, or commerce feature not found |
| `422` | Validation error |


---