Arcane.users.applyPassword()

This focused page is derived from the mechanically checked full member inventory.

Syntax

Arcane.users.applyPassword(username, temporaryPassword)

Parameters

Username; exact temporary password from the current workflow

Return value

Promise<{user, operation, credentials}>

Description

Performs the privileged native password mutation and forces change at next sign-in.

Overview

Arcane.users.applyPassword(username, temporaryPassword) applies the exact temporary password produced by the current Provisioner workflow. It is a privileged, exclusive, non-idempotent Core mutation requiring users.manage and the Provisioner type. It changes the local operating-system password and forces a change at the next sign-in.

Do not construct a password yourself. The accepted handoff has the generated A! prefix, 16 base64url characters, and 9z suffix. Keep it in memory only long enough to show and apply it; never place it in a URL, log, diagnostic, or ordinary storage.

Result, side effects, and events

The exact result is {user, operation, credentials} with an empty credentials array. user contains username, passwordReset: true, mustChangeAtNextSignIn: true, applyPasswordRequired: false, and passwordStatus: "temporary-issued", plus sid/uid or enabled where the native host reports it. Standard operation events are emitted with redacted command diagnostics.

Errors and recovery

INVALID_TEMPORARY_PASSWORD rejects anything outside the exact generated handoff. USER_NOT_FOUND and NOT_ARCANE_USER block a changed or inactive account. Platform reset failures retain redacted diagnostics. After an ambiguous failure, do not generate a different secret immediately: refresh the account state and follow the error's reconciliation guidance, because the first password may already have been accepted.

Example

async function applyPreparedPassword(prepared) {
    const credential = prepared?.credentials?.[0];
    if (!credential || credential.applyPasswordRequired !== true) {
        throw new Error('A current prepared credential is required.');
    }
    return Arcane.users.applyPassword(
        credential.username,
        credential.temporaryPassword
    );
}

Reference group

Platform, installation, users, and system