v8

OpenAPI 3.1.02026-08-033623795.0 MB

Users

Delete

Deletes one of the authenticated user's own passkeys. The request body carries a WebAuthn assertion from the passkey being deleted, so possession of the credential is proven before it is removed: mint a deletion challenge for it first, run the ceremony with that passkey, and send the result here. Deleting the user's last passkey is allowed — their other step-up factors remain. Requires a user session.

delete/users/me/passkeys/{id}

Request body

authenticator_datastring required

The authenticatorData from the WebAuthn assertion, base64url-encoded.

client_data_jsonstring required

The clientDataJSON from the WebAuthn assertion, base64url-encoded.

signaturestring required

The signature from the WebAuthn assertion, base64url-encoded.

Response

passkey deleted

deletedboolean required

Always true: the passkey was removed.

idstring required

The ID of the deleted passkey.