Removes one of the caller's passkeys.

DELETE

/api/v1/account/passkeys/{id}

Why the last way in cannot be removed

An account with no password, no linked provider and one passkey would be locked out the moment that passkey went, and would only find out at the next sign-in. The same rule unlinking a provider follows.

Errors

403 when a bearer token was used, 404 when no passkey of the caller's has that id, 409 when it is the account's only way in.

Authorization

session

cookietessera_session<token>

Set by POST /auth/login. A browser sends it automatically; it is HttpOnly, so page scripts cannot read or set it.

Path Parameters

id*string

Which passkey

Response Body

Removed

curl -X DELETE 'https://example.com/api/v1/account/passkeys/string'

Empty