Reset secret
Permanently deletes the user's existing secret. Frozen status, rejection counter, and device binding are all cleared. The answer carries a new secret with its QR image and 10 new recovery codes, valid for 5 minutes: the user links their phone again with it.
POST/auth/secret/reset
Body parameters
| Parameter | Type | Description |
|---|---|---|
externalUsername | string | Your user ID Required |
Caution: This action is irreversible. The old secret becomes invalid. The user must re-register in the mobile app.
Unfreeze: If a user has been frozen due to too many rejections, a reset also clears the
frozen status.Request
const { Touchque } = require('@touchque/node');
const tq = new Touchque({
apiKey: 'tq_abc123',
apiSecret: 'YOUR_API_SECRET'
});
async function resetDevice() {
// Permanently replaces the user's current secret and returns the new one
const reset = await tq.auth.resetSecret({
externalUsername: 'user@yourcompany.com'
});
// reset = { secret, qrCodeDataUrl, recoveryCodes, expiresAt, externalUsername }
// The new secret is valid for 5 minutes: relink the phone with reset.qrCodeDataUrl
console.log('New secret:', reset.secret);
}
resetDevice();<?php
require_once 'vendor/autoload.php';
use Touchque\Touchque;
use Touchque\Config;
$tq = new Touchque(new Config('tq_abc123', 'YOUR_API_SECRET'));
try {
// Permanently resets the user's current secret and returns the new one
$reset = $tq->auth->resetSecret('user@yourcompany.com');
// The new secret is valid for 5 minutes: relink the phone with $reset['qrCodeDataUrl']
echo "New Secret: " . $reset['secret'];
} catch (\Exception $e) {
echo "Error: " . $e->getMessage();
}package main
import (
"fmt"
"log"
"github.com/Touchque/touchque-go/v5/touchque"
)
func main() {
tq, err := touchque.New(touchque.DefaultConfig("tq_abc123", "YOUR_API_SECRET"))
if err != nil {
log.Fatal(err)
}
// Permanently resets the user's current secret and returns the new one
reset, err := tq.Auth.ResetSecret("user@yourcompany.com")
if err != nil {
log.Fatal(err)
}
// The answer is the new secret (valid for 5 minutes): relink the phone with reset.QRCodeDataURL
fmt.Println("New Secret:", reset.Secret)
}from touchque import Touchque, Config
tq = Touchque(Config(api_key="tq_abc123", api_secret="YOUR_API_SECRET"))
# Permanently resets the user's current secret and returns the new one
reset = tq.auth.reset_secret("user@yourcompany.com")
# The new secret is valid for 5 minutes: relink the phone with reset['qrCodeDataUrl']
print("New Secret:", reset["secret"])var tq = new TouchqueClient(new TouchqueOptions { ApiKey = "tq_abc123", ApiSecret = "YOUR_API_SECRET" });
// Permanently resets the user's current secret and returns the new one
var reset = await tq.Auth.ResetSecretAsync("user@yourcompany.com");
Console.WriteLine($"New Secret: {reset.Secret}"); // reset.QrCodeDataUrl relinks the phonevar tq = new TouchqueClient(new TouchqueOptions().apiKey("tq_abc123").apiSecret("YOUR_API_SECRET"));
// Permanently resets the user's current secret and returns the new one
JsonNode reset = tq.auth().resetSecret("user@yourcompany.com");
System.out.println("New Secret: " + reset.path("secret").asText()); // reset.path("qrCodeDataUrl") relinks the phonetq = Touchque::Client.new(api_key: "tq_abc123", api_secret: "YOUR_API_SECRET")
# Permanently resets the user's current secret and returns the new one
reset = tq.auth.reset_secret("user@yourcompany.com")
puts "New Secret: #{reset["secret"]}" # reset["qrCodeDataUrl"] relinks the phone# 1) Generate signature
BODY='{"externalUsername": "user@yourcompany.com"}'
BODY_HASH=$(echo -n "$BODY" | openssl dgst -sha256 | awk '{print $2}')
TS=$(date +%s000)
NONCE=$(openssl rand -hex 16)
MSG="POST:/auth/secret/reset:$TS:$NONCE:$BODY_HASH"
SIG=$(echo -n "$MSG" | openssl dgst -sha256 -hmac "YOUR_API_SECRET" | awk '{print $2}')
# 2) Send request
curl -X POST https://api.touchque.com/auth/secret/reset \
-H "x-api-key: tq_abc123" \
-H "x-signature: $SIG" \
-H "x-timestamp: $TS" \
-H "x-nonce: $NONCE" \
-H "Content-Type: application/json" \
-d "$BODY"Response 200
{
"success": true,
"secret": "A1B2C3D4E5F6A7B8C9D0E1F2",
"qrCodeDataUrl": "data:image/png;base64,…",
"externalUsername": "user@yourcompany.com",
"message": "Secret reset successfully",
"expiresAt": "2026-11-02T12:05:00.000Z",
"recoveryCodes": ["…", "…"]
}