Skip to content
LogoLogo

Remove a passkey

Remove a passkey

DELETE/api/v1/auth/passkeys/{passkey_id}

Removes a passkey from the account. This does not tell the authenticator to forget its copy; the user removes that separately in their platform's own passkey settings.

A passkey belonging to another account is 404, the same answer a malformed identifier receives — a passkey identifier belongs to exactly one account, so the two must not be distinguishable.

Removing the account's last remaining sign-in method is refused with 409 last_sign_in_method. An account with a passkey and no password could otherwise lock itself out in a single request with nothing left to recover with. A password, a linked identity provider, or another usable passkey each satisfy the requirement; a passkey disabled by a clone signal does not, because it is not a way back in.

Path Parameters

passkey_idRequired
string <uuid>
Example0198ac5e-f9b7-7000-8000-000000000001

Header Parameters

X-CSRF-TokenRequired
string·min 43·max 43

Session-bound CSRF token. It must exactly match the __Host-assign_csrf cookie sent with the request.

Responses

Authentication · Conventions and errors · API guides · Resource reference