# Change your password

`POST https://api.twittrapi.com/client/password`

Change the password of your account. Returns the new auth_token, because X logs out every session when the password changes.

HTML page: https://www.twittrapi.com/docs/account-actions/client-password

> Account actions run with the session cookie of your own X account and go out through your own proxy. Use only accounts you control and follow X's rules; automated posting, following or liking can get the account limited or suspended. Treat the cookie like a password. Trial keys cannot call these endpoints.

Runs the same request as Settings → Change your password on x.com.

On success X ends every session of the account, including the cookie you sent, and sets a new auth_token. The answer carries it as auth_token, next to ct0, which stays the same. Replace auth_token in your stored cookie with the new value before the next call; the old cookie no longer works.

## Parameters

| Name | In | Type | Required | Default | Description |
| --- | --- | --- | --- | --- | --- |
| `cookie` | body | string | yes |  | Cookie header of your own logged-in X session: auth_token=...; ct0=... (guest_id is used when present). How to copy it: /docs/x-session. |
| `proxy` | body | string | yes |  | Your proxy, format http://user:pass@host:port. The requests to X go out through it. Used only for this request. |
| `current_password` | body | string | yes |  | The password the account has now. |
| `password` | body | string | yes |  | The new password, at least 8 characters. |
| `password_confirmation` | body | string | no |  | The new password again. Left out, password is used; when set, it must match password. |

Body parameters are sent as a JSON object with `Content-Type: application/json`.

## Notes

- X refuses a wrong current_password; the answer then has X's status and body, and the password stays unchanged.
- The new password is not stored or logged by the API.
- No simple format: with format=simple the answer is the usual {status_code, response} wrapper.
- The `cookie` and `proxy` fields: https://www.twittrapi.com/docs/x-session

## Response

Wrapper built by the API: {"status_code": <X status>, "response": "<X response body as a string>", "auth_token": "<new auth_token>", "ct0": "<ct0>"}. On success X's body is {"status":"ok"}. auth_token and ct0 are only present after a successful change. The HTTP status is X's status when X answered 4xx or 5xx, otherwise 200.

## Errors

| Status | When |
| --- | --- |
| 400 | The body is not valid JSON. |
| 422 | A required field is missing (including proxy), an ID is not numeric, or the cookie has no ct0. Also: the account is suspended, X rejected the session, or the text was already posted. |
| 407 | The proxy is unreachable or timed out. |
| 422 | current_password or password is missing, password is shorter than 8 characters, or password and password_confirmation do not match. Checked before anything is sent to X. |
| 503 | X did not accept the request right now. Try again later; the password is unchanged. |
| X's status | Any status X answers with (for example 401, 403, 404): passed through with X's body. |

Shared errors (401 missing key, 402 no balance, 429 rate limit, 5xx) are listed on https://www.twittrapi.com/docs/helpful-infos/error-handling. Calls that fail with 400, 407, 408, 409 or a 5xx error are refunded.

## Example request

curl:

```bash
curl -X POST 'https://api.twittrapi.com/client/password' \
  --header 'X-API-KEY: YOUR_API_KEY' \
  --header 'Content-Type: application/json' \
  --data '{"cookie":"auth_token=...; ct0=...","proxy":"http://user:pass@host:port","current_password":"old-password","password":"new-password-123"}'
```

Python:

```python
import httpx

resp = httpx.post(
    "https://api.twittrapi.com/client/password",
    headers={"X-API-KEY": "YOUR_API_KEY"},
    json={
        "cookie": "auth_token=...; ct0=...",
        "proxy": "http://user:pass@host:port",
        "current_password": "old-password",
        "password": "new-password-123",
    },
    timeout=60,
)
print(resp.status_code, resp.json())
```

Node.js:

```js
const resp = await fetch("https://api.twittrapi.com/client/password", {
  method: "POST",
  headers: { "X-API-KEY": process.env.TWITTRAPI_API_KEY, "Content-Type": "application/json" },
  body: JSON.stringify({
    cookie: "auth_token=...; ct0=...",
    proxy: "http://user:pass@host:port",
    current_password: "old-password",
    password: "new-password-123",
  }),
});
console.log(resp.status, await resp.json());
```