List the current account's passkeys
List the current account's passkeys
/api/v1/auth/passkeysReturns every registered passkey, including any disabled by a clone signal — a disabled credential stays listed because that is how the user finds out something happened to it.
The list is bounded by the ten-passkey registration limit and is not paginated. Public keys and attestation data are deliberately absent: a client has no use for them.
Header Parameters
stringUpcoming browser-session canonical read custody. The named private scope captures this response and a signed replay cursor in one snapshot. Successful responses include X-Assign-Realtime-Cursor and X-Assign-Realtime-Position. Apply all required retained state before acknowledging the corresponding socket checkpoint. Failed or incomplete baselines return no cursor.
account_securityResponses
string·const no-storePrevents storage of error responses by clients and intermediaries.
string·min 1·max 200Correlation identifier for the request.
string·const nosniffPrevents user agents from MIME-sniffing the response.
string·max 4096Signed scope/User/session-bound replay custody; only when the requested canonical baseline succeeds.
stringDecimal-string snapshot position; only with a successful baseline cursor.
string·const no-storePrevents storage of error responses by clients and intermediaries.
string·min 1·max 200Correlation identifier for the request.
string·const nosniffPrevents user agents from MIME-sniffing the response.
integer·min 1Seconds until the client may retry.
integer·min 0Delay in seconds before retrying, when an expected maintenance end is known.
string·const no-storePrevents storage of error responses by clients and intermediaries.
string·min 1·max 200Correlation identifier for the request.
string·const nosniffPrevents user agents from MIME-sniffing the response.