Reset or Retrieve the Root Password of Your Server or VM — Portal and API

Method 1 — In the portal

Read back a recently issued password

1. Log in at amoni.app and open the server (Servers) or instance (Virtual Machines).
2. On the Overview tab, the Access card shows Root password (issued at reinstall) or (issued at reset) while we still hold one, with Show and Copy and how long it stays available.

If the card only says the password is not stored, it was issued more than 48 hours ago (or never generated because you set your own). Move on to a reset.

Cloud instances: reset the password

1. On the instance's Overview tab, in the Access card, click reset password. (The Settings tab has the same button under Root Password.)
2. Confirm. A new strong password is generated for the machine's administrative user: root on Linux, Administrator on Windows. The dialog names the user.
3. Copy it from the New password dialog. It is shown once here and then held under Access for 48 hours. Click I have saved it.

When does it take effect? The confirmation message tells you which of two things happened:

• “Password updated … and active now” — the running system accepted it through its guest agent. Log in straight away. No reboot needed.
• “Password stored … but it is NOT active yet” — this instance has no responding guest agent. The password is saved for the next rebuild; a reboot will not apply it. To get in now, use the remote console and change the password from inside, or boot a rescue image.

Bare-metal servers: set a new password from rescue mode

There is no reset button for bare metal, because nothing on our side can change a password inside your installed system. Instead:

1. Boot the server into rescue mode and connect over SSH with the rescue password.
2. Mount the installed system and enter it:

   mount /dev/sda2 /mnt        # your root filesystem; check with lsblk -f
   mount --bind /dev /mnt/dev; mount --bind /proc /mnt/proc; mount --bind /sys /mnt/sys
   chroot /mnt /bin/bash
   passwd root
   exit
   umount -R /mnt

3. Reboot from the server header. The installed system comes up with the new password.

For Windows, the equivalent is the Windows recovery template in rescue mode, or a reinstall if the data can be lost.

Method 2 — With the API

Password endpoints need a write scope even to read (servers.write or vms.write): the scope reflects what the value is, not the HTTP verb. Reference: api.amoni.app/v1/docs.

Read back a held password

curl -s https://api.amoni.app/v1/servers/955/root-password \
  -H "Authorization: Bearer nr_live_..."
# or, for an instance:
curl -s https://api.amoni.app/v1/vms/990204/411/root-password \
  -H "Authorization: Bearer nr_live_..."

{ "success": true, "data": { "password": "Vq7#kL2m!pX9rT4w", "expires_in": 158400 } }

404 with code: root_password_unavailable means it expired or was never generated; the two are deliberately indistinguishable. Once stored on your side, discard it early with DELETE on the same path.

Cloud instances: reset

Send an empty body to have a password generated, or your own password (12 to 128 characters). A password you supply is never echoed back and never stored.

curl -s -X PUT https://api.amoni.app/v1/vms/990204/411/password \
  -H "Authorization: Bearer nr_live_..." \
  -H "Content-Type: application/json" \
  -d '{}'

{
  "success": true,
  "data": {
    "password": "Hq6!vN3k#zW8sM2y",
    "generated": true,
    "username": "root",
    "applied": "agent",
    "message": "Password updated for user \"root\" and active now — no reboot needed."
  }
}

Branch on applied: agent means the running guest has it now; pending_rebuild means it is stored for the next rebuild and the console is the way in meanwhile.

What the API will tell you