Sign in
Embedded Wallet Auth

Revoke an authentication credential

Revoke an authentication credential on an Embedded Wallet internal account.

Revocation is a two-step flow because it must be authorized by a session on a different credential on the same internal account:

  1. Call DELETE /auth/credentials/{id} with no headers. The response is 202 with a payloadToSign, requestId, and expiresAt.

  2. Sign the payloadToSign with the session private key of an existing verified credential on the same internal account — other than the one being revoked — and retry the same DELETE request with the signature supplied as the Grid-Wallet-Signature header and the requestId echoed back as the Request-Id header. The signed retry returns 204.

The account must retain at least one authentication credential; an account with only a single credential cannot use this endpoint to revoke it.

delete/auth/credentials/{id}

Path parameters

idstring required

The id of the authentication credential to revoke (the id field of the AuthMethod returned from POST /auth/credentials).

Headers

Grid-Wallet-Signaturestring

Signature over the payloadToSign returned in a prior 202 response, produced with the session private key of an existing verified authentication credential on the same internal account (other than the one being revoked) and base64-encoded. Required on the signed retry; ignored on the initial call.

Request-Idstring

The requestId returned in a prior 202 response, echoed back on the signed retry so the server can correlate it with the issued challenge. Required on the signed retry; must be paired with Grid-Wallet-Signature.

Response

Challenge issued. The response contains a payloadToSign that must be signed with the session private key of an existing verified credential on the same internal account (other than the one being revoked), along with a requestId that must be echoed back on the retry.

payloadToSignstring required

Payload that must be signed with the session private key of a verified authentication credential. The resulting signature is passed as the Grid-Wallet-Signature header on the retry of the originating request to complete the operation.

requestIdstring required

Unique identifier for this request. Must be echoed in the Request-Id header on the signed retry so the server can correlate the retry with the issued challenge.

expiresAtstring date-time required

Timestamp after which this challenge is no longer valid. The signed retry must be submitted before this time.

type'OAUTH' | 'EMAIL_OTP' | 'PASSKEY' required

The type of authentication credential.

  • OAUTH: OpenID Connect (OIDC) token issued by an identity provider such as Google or Apple.
  • EMAIL_OTP: A one-time password delivered to the user's email address.
  • PASSKEY: A WebAuthn passkey bound to the user's device.

Example response

{
  "payloadToSign": "Y2hhbGxlbmdlLXBheWxvYWQtdG8tc2lnbg==",
  "requestId": "7c4a8d09-ca37-4e3e-9e0d-8c2b3e9a1f21",
  "expiresAt": "2026-04-08T15:35:00Z"
}

Changes