---
title: "Get someone's personal set-password link"
description: "Create a password-setting link for this person only, at the suite's address."
canonical: "https://grid82.com/docs/builder-api/users/password-link"
updated: "2026-11-13"
---

# Get someone's personal set-password link

`POST https://studio.grid82.app/v1/users/{userId}/password-link`

Create a password-setting link for this person only, at the suite's address.

Directory membership does not prove ownership; hand them the link for access without Google because the platform sends no email. Valid once for seven days; a new link retires the previous one. Refused for someone who can already sign in. An unverified self-sign-up does not count: using the link replaces its password and ends its sessions and keys. URL returned once, never stored in clear.

Requires the `members:write` scope. Operation `users.passwordLink`. Not an MCP tool. A set-password link is a credential for another person: whoever holds it becomes them. It is handed over by a builder, from the Studio or the CLI, and never passes through a model's context. CLI: `grid82 users password-link` (`npx grid82`).

## Path parameters

| Name     | Type   | Required | Description |
| -------- | ------ | -------- | ----------- |
| `userId` | string | yes      |             |

## Headers

| Name              | Type   | Required | Description                                                                                                                                                                                                                                                        |
| ----------------- | ------ | -------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ |
| `Idempotency-Key` | string | no       | Any unique string. Sending the same key with the same request again returns the first response (marked `Idempotency-Replayed: true`) instead of running it twice. Reusing it for a different request is refused with 409. Kept for 24 hours. Up to 255 characters. |

**Authorizations**

- `Authorization` (bearer, in header, required)

## Response

**201**: Success

- `data` (`object`, required)
- `data.userId` (`string`, required)
- `data.url` (`string`, required)
- `data.expiresAt` (`string`, required)

```json
{
  "data": {
    "userId": "<string>",
    "url": "<string>",
    "expiresAt": "<string>"
  }
}
```

**4XX**: Refused

- `error` (`object`, required)
- `error.code` (`enum<string>`, required, one of: `not_found, forbidden, unauthenticated, validation_failed, conflict, rate_limited, payment_required, not_implemented, internal`)
- `error.message` (`string`, required)
- `error.details` (`Record<string, unknown>`)

```json
{
  "error": {
    "code": "not_found",
    "message": "<string>",
    "details": {}
  }
}
```

**Example request**

```bash
curl --request POST \
  --url 'https://studio.grid82.app/v1/users/<userId>/password-link' \
  --header 'Authorization: Bearer <token>'
```