opschain passwd

Included from Basic tier

Change the logged-in user's own password on the targeted server, over the v2 AuthService.ChangePassword RPC, authenticated with the stored login token. Local users only — directory (LDAP) passwords are managed in the directory, and the server refuses directory-managed identities with a named error.

Interactively, the current and new passwords are prompted without echo, and the new password is retyped for confirmation:

opschain passwd
Current password:
New password:
Retype new password:
Password changed.

For scripts, each password is read from a named environment variable — the name is passed, never the value, so no password lands in shell history or the process list:

opschain passwd --current-password-env OLD_PW --new-password-env NEW_PW

Piped stdin also works (one password per line: current, new, confirmation — the confirmation line is only read when the new password was prompted rather than taken from the environment).

Flags

Flag	Meaning
--current-password-env <NAME>	Environment variable holding the current password.
--new-password-env <NAME>	Environment variable holding the new password. Supplying it skips the retype confirmation.

Named errors

• passwd needs a server — pass --server <url>, set OPSCHAIN_SERVER, or 'opschain context use <name>'
• the environment variable <NAME> is not set (or empty)
• the new passwords do not match
• no password provided (pipe it on stdin, or run from a terminal)

All exit 2. A wrong current password, a new password the server's policy refuses (minimum length, history), or a directory-managed identity exit 1 with the server's JSONAPI error.

Exit codes

Code	Meaning
0	Password changed.
1	The server refused the change or was unreachable.
2	Usage error (see Named errors).

See also

• opschain docs cli/login — the stored token this command authenticates with.