---
title: "List"
method: GET
path: "/users/me/passkeys"
tags: ["Users"]
---

# List

`GET /users/me/passkeys`

Lists the authenticated user's own passkeys, newest first. The list is always the caller's own; there is no parameter for reading another user's passkeys. Requires a user session: an API key or an OAuth token is refused, because a passkey confirms the account holder before a sensitive action and no app may enumerate one.

## Query parameters

- `first` integer
- `after` string
- `last` integer
- `before` string
- `order` 'created_at'
- `direction` 'asc' | 'desc'

## Response `200`

passkeys listed

- object
  - `data` Passkey[], required
    - `created_at` string, required — When the user registered this passkey, as an ISO 8601 timestamp.
    - `credential_id` string, required — The WebAuthn credential ID as a base64url string. Pass it in `allowCredentials` when you run a ceremony against this specific passkey.
    - `id` string, required — Passkey ID, prefixed `wcred_`. Use it to delete the passkey.
    - `last_used_at` string, nullable, required — When this passkey last completed a WebAuthn ceremony, as an ISO 8601 timestamp, or `null` if it never has.
    - `nickname` string, required — The name the user gave this passkey, usually the device it lives on.
  - `page_info` object, required
    - `end_cursor` string, nullable, required
    - `has_next_page` boolean, required
    - `has_previous_page` boolean, required
    - `start_cursor` string, nullable, required

## Other responses

- `400` — Invalid Parameters
- `401` — Unauthorized
- `403` — Forbidden

---

[API](https://skmtc.net/whop/apis/whop-api.md) · [All operations](https://skmtc.net/whop/apis/whop-api/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/whop/whop-api/versions/a8a43db4255f/schema)