The API accepts beta passwords of 10 to 128 characters. The previous 15-character minimum is gone. The maximum is unchanged.

Merged into backend staging in #595 as 3f0f46e9. Not deployed. Local gates only.