updateMeCredentials()

updateMeCredentials writes a new value for one or more of the signed-in user's own credentials, for example their password, or any other attribute the user type schema declares credential: true for (a PIN, say). It posts to the same /users/me/update-credentials endpoint the React and Vue SDKs' <ChangeCredential /> component uses, so a vanilla app gets the same behavior without a UI framework.

note

updateMeCredentials collects only a new value, not the account's existing one. The self-service credential write path does not verify the current value today, so asking for one would only teach the user a false sense of security.

Signature

updateMeCredentials(config: UpdateMeCredentialsConfig): Promise<void>

Responds 204 No Content on success, so this resolves with void rather than a parsed body.

Parameters

Parameter	Type	Required	Description
config.baseUrl	string	❌	Base path of the API. Used to derive the endpoint when url isn't set.
config.url	string	❌	Absolute endpoint URL. Takes precedence over baseUrl.
config.payload	Record<string, string>	✅	New values keyed by credential attribute, e.g. { password: '...' }. One or more may be included in a single call.
config.fetcher	(url, config) => Promise<Response>	❌	A function that attaches the access token to the request, whether hand-rolled from auth.getAccessToken() or built with createHttpClientFetcher. Falls back to native fetch when omitted, which won't be authenticated.

Returns

Promise<void>

Throws

ThunderIDAPIError with statusCode set from the response. 400 means the new value failed a server-side check; anything else has no single field to blame. See mapCredentialUpdateError() for turning this into a form-attachable message.

Usage

src/pages/account.js

import { CredentialConstants, updateMeCredentials } from '@thunderid/browser'

function createFetcher(auth) {
  return async (url, config) => {
    const token = await auth.getAccessToken()
    return fetch(url, {
      ...config,
      headers: { ...config.headers, Authorization: `Bearer ${token}` },
    })
  }
}

await updateMeCredentials({
  baseUrl: 'https://localhost:8090',
  payload: { [CredentialConstants.PASSWORD]: 'n3wP@ssword!' },
  fetcher: createFetcher(auth),
})

Related

• CredentialConstants: Well-known credential attribute names
• evaluateChangePasswordForm(): Validate a new value and its confirmation before submitting
• supportsCredential(): Check whether the account can set this credential at all
• mapCredentialUpdateError(): Map a failure onto the field that caused it
• createHttpClientFetcher(): Build an authenticated fetcher