---
title: "Delete an enrolled passkey"
method: POST
path: "/user/passkey/delete"
tags: ["Enrollment"]
---

# Delete an enrolled passkey

`POST /user/passkey/delete`

## Request body

- object
  - `userId` string, required
  - `credentialId` string, required

## Response `200`

Passkey deleted. Returns the refreshed MFA state.

- object
  - `deleted` boolean, required
  - `credentialId` string, required
  - `multiFactorAuth` object, required
    - `enabled` boolean, required
    - `primaryMethod` 'totp' | 'passkey' | 'sms'
    - `enrolledMethods` string[], required
    - `passkeyCount` integer, required

## Other responses

- `400` — Request was rejected. The `errorCode` field disambiguates.
- `401` — Invalid API key or HMAC signature.

---

[API](https://skmtc.net/striga/apis/striga-v1.md) · [All operations](https://skmtc.net/striga/apis/striga-v1/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/striga/striga-v1/revisions/63e57aa7df45/schema)