---
title: "List user's passkeys"
method: GET
path: "/api/v1/webauthn/credentials"
tags: ["Passkeys"]
---

# List user's passkeys

`GET /api/v1/webauthn/credentials`

Retrieves all registered passkeys for the current user, including device information, creation timestamps, and display names. Use this to show users their registered authenticators.

## Query parameters

- `user_id` string

## Response `200`

List of passkeys with metadata

- WebauthnListCredentialsResponse
  - `all_accepted_credentials_options` WebauthnAllAcceptedCredentialsOptions
    - `all_accepted_credential_ids` string[] — List of credential IDs the user can authenticate with
    - `rp_id` string — Relying Party ID for credential operations
    - `user_id` string — User ID for credential verification
  - `credentials` WebauthnWebAuthnCredential[] — All passkeys registered for the user
    - `attestation_type` string — Type of attestation: "none", "indirect", or "direct"
    - `authenticator` WebAuthnCredentialAuthenticator
      - `aaguid` string — Authenticator Attestation GUID (AAGUID) identifying the device model
      - `attachment` string — Attachment type: "platform" (built-in) or "cross-platform"
      - `icon_dark` string — Icon URL for dark theme display
      - `icon_light` string — Icon URL for light theme display
      - `name` string — Human-readable name of the authenticator model
    - `authenticator_flags` WebAuthnCredentialAuthenticatorFlags
      - `backup_eligible` boolean — Whether this credential can be backed up to another device
      - `backup_state` boolean — Whether this credential was synced or backed up
      - `user_present` boolean — Whether the user was present during authentication
      - `user_verified` boolean — Whether the user was verified (e.g., fingerprint, PIN)
    - `client_info` WebAuthnCredentialClientInfo
      - `city` string — City name
      - `ip` string — IP address from which credential was registered
      - `region` string — Geographic region (e.g., "US")
      - `region_subdivision` string — Regional subdivision (e.g., "CA")
    - `created_at` string, date-time — Timestamp when the credential was created
    - `credential_id` string, byte — The actual credential ID bytes from the authenticator
    - `display_name` string — Optional user-friendly name for this passkey
    - `id` string — Credential unique identifier
    - `transports` string[] — Supported transports for this credential
    - `updated_at` string, date-time — Timestamp of last update
    - `user_agent` WebAuthnCredentialUserAgent
      - `browser` string — Browser name (e.g., "Chrome", "Safari")
      - `browser_version` string — Browser version number
      - `device_model` string — Device model if available
      - `device_type` string — Device type: "desktop", "mobile", or "tablet"
      - `os` string — Operating system name (e.g., "Windows", "iOS")
      - `os_version` string — Operating system version
      - `raw` string — Raw user agent string from the browser
      - `url` string — Parsed user agent URL reference
    - `user_id` string — User ID this credential belongs to

---

[API](https://skmtc.net/scalekit/apis/scalekit-api-reference.md) · [All operations](https://skmtc.net/scalekit/apis/scalekit-api-reference/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/scalekit/scalekit-api-reference/versions/a40d5d4650e5/schema)