Set a direct password

When SSO creates a user, ExuraCopy assigns a random password that is not shared with either the CRM or the user. PATCH /api/v1/users/password replaces it with a password selected by the customer.

The user can continue accessing Social Trading through SSO after setting a direct password.

Request

curl -X PATCH "https://social-api.example.com/api/v1/users/password" \
  -H "Authorization: Bearer YOUR_CRM_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{
    "external_reference": "crm-user-127",
    "new_password": "Use-A-Strong-Unique-Password"
  }'

The CRM must identify the user through external_reference. Do not depend on ExuraCopy’s internal user_id for this workflow.

Response

{
  "user_id": 42,
  "email": "[email protected]",
  "external_reference": "crm-user-127",
  "password_changed": true,
  "updated_at": "2026-07-22T18:05:00Z"
}

Secure handling

Collect the password through a protected CRM form.
Require confirmation and apply your own complexity rules.
Do not record the value in logs, analytics, traces, or screenshots.
Send it only once from the backend to ExuraCopy.

If the API responds with 404, first run the SSO workflow to create or link the user.

Previous: SSO session

Return to the user creation and access workflow.

Next: Retrieve the wallet

Obtain the user’s authoritative balance.

Last modified on November 3, 2026

Getting Started

Integration Flows

Reliability

Request

Response

Secure handling

​Request

​Response

​Secure handling

Previous: SSO session

Next: Retrieve the wallet

Request

Response

Secure handling