Sign in
latestOpenAPI 3.1.02026-08-163864115.7 MB

c363cb2feb95

Users

Delete

Deletes one of the authenticated user's own passkeys. The request body carries a WebAuthn assertion from the passkey being deleted, so possession of the credential is proven before it is removed: mint a deletion challenge for it first, run the ceremony with that passkey, and send the result here. Deleting the user's last passkey is allowed — their other step-up factors remain. Requires a user session.

delete/users/me/passkeys/{id}

Request body

authenticator_datastring required

The authenticatorData from the WebAuthn assertion, base64url-encoded.

client_data_jsonstring required

The clientDataJSON from the WebAuthn assertion, base64url-encoded.

signaturestring required

The signature from the WebAuthn assertion, base64url-encoded.

Example request

{
  "authenticator_data": "YXV0aGVudGljYXRvci1kYXRh",
  "client_data_json": "Y2xpZW50LWRhdGE",
  "signature": "c2lnbmF0dXJl"
}

Response

passkey deleted

deletedboolean required

Always true: the passkey was removed.

idstring required

The ID of the deleted passkey.

Example response

{
  "deleted": true,
  "id": "wcred_xxxxxxxxxxxxxx"
}