Skip to main content
User passwords are collected by your platform and sent to the Business API during user creation. Passwords are stored hashed; never log them or store them in plaintext in your own systems.

​
Password policy

Passwords must be at least 8 characters and include:
  • one lowercase letter
  • one uppercase letter
  • one number
  • one special character
confirmPassword must match password on create, and confirmPassword must match newPassword on password change.

​
Set the initial password

Include password and confirmPassword when creating a user.
Create user password fields
See Create and manage users for the full create-user request.

​
Change a user password

Use POST /users/{userId}/password when the end user knows their current password and needs to change it.
POST /users/USER_ID/password
The new password must satisfy the same policy as create-user passwords and cannot be the same as the old password.