Account settings — change password

The dealer Account → Change password screen calls Gommo’s platform auth app. Integrators building account settings in a white-label app use the same upstream path with the signed-in user’s access_token.

Use your registration domain in the form body — not the API hostname.

→ Account — sign up · Transfer credits · Session devices · Support tickets · Partner program · Creator rewards

Playground

Playground — Home feed → Platform → Change password (and Transfer credits on the same section) when running npm run docs:stack. Connect an account first; sends real data to upstream.

Upstream stability

Captures from dealer apps sometimes show HTTP 500 or an empty / non-JSON response body, which breaks clients that always JSON.parse the response. When using optional gateway Mode B, empty or non-JSON upstream bodies are normalized to a JSON error envelope with code: UPSTREAM_ERROR and raw.http_status.

Not AI project password

POST /api/v2/ai-projects with action=set_password protects a shared project — not the user login password. See AI projects.

Change password

POST https://api.gommo.net/api/apps/go-mmo/auth/change-password
Content-Type: application/x-www-form-urlencoded

Field	Required	Notes
access_token	yes	User session token (same as login)
domain	yes	Registration domain
current_password	yes	Existing login password
new_password	yes	New login password
language	optional	UI locale upstream (e.g. EN, VI)
device_id, device_name, device_info	optional	Same device pattern as login / profile

PowerShell (replace domain; use a real token and passwords only in a secure session):

$domain = $env:GOMMO_API_DOMAIN
if (-not $domain) { throw 'Set GOMMO_API_DOMAIN to your registration domain' }
$h = @{ 'Content-Type' = 'application/x-www-form-urlencoded' }
$body = "access_token=$env:TOKEN&domain=$domain&current_password=$env:CURRENT_PASSWORD&new_password=$env:NEW_PASSWORD&language=EN"
Invoke-RestMethod -Method Post -Uri 'https://api.gommo.net/api/apps/go-mmo/auth/change-password' -Headers $h -Body $body

On success, upstream typically returns a Gommo JSON envelope (success, message, …). Treat success: false or HTTP ≥ 400 as failure even when the body parses.

Mode B (optional gateway)

POST {gateway}/gateway/auth/change-password — Bearer required; JSON body:

{
  "current_password": "…",
  "new_password": "…",
  "language": "EN"
}

Server fills access_token and domain from the Bearer session and tenant context. Optional device_id, device_name, device_info match login.

• Valid JSON upstream → pass-through (same HTTP status and body shape).
• Empty or non-JSON upstream → gateway JSON { success: false, code: "UPSTREAM_ERROR", raw: { http_status, body? } }.

OpenAPI: openapi.yaml — /gateway/auth/change-password.

See Endpoint map and Deploy → Self-host (advanced).