Request a one-time code to change your password
Emails a 6-digit code to the logged-in user, valid briefly. Submit it to /auth/change-password along with the new password. Requires an existing session (log in first) and an Admin or Owner role - a Member/Viewer session gets a 403 here.
Authorization
sessionAuth A session token for an existing account, obtained from POST /auth/login (see the Authentication endpoints) - not an API key. Endpoints marked with this scheme reject API key callers outright, regardless of what that key is granted. Outside the Authentication endpoints themselves, everything requiring this scheme manages dashboard resources (schedules, rules, grants, keys, device configuration) and mirrors what a human does in the Nexalware web app - it is not meant to be automated by a third-party integration the way the Device Control endpoints are.
In: header
Response Body
application/json
application/json
application/json
application/json
curl -X POST "https://example.com/api/v1/auth/password/request-otp"{ "ok": true}Log in and obtain a session token POST
Exchanges an existing account's email/password for a token pair. This is how a third-party client (your own app, a custom login screen, a CLI) authenticates a user directly, without going through the Nexalware dashboard UI. Creating a *new* account is dashboard-only (nexalware.com/sign-up) and is not exposed here - this endpoint only signs in an account that already exists.
Revoke a refresh token POST
Invalidates the given refresh token so it can no longer be exchanged for new sessions. The current access token stays valid until its own 15-minute expiry - this only prevents renewing it.