---
title: "Remove a registered passkey. Requires a step-up proof. (Roles: user)"
method: DELETE
path: "/auth/2fa/webauthn/{credentialId}"
tags: ["Authentication"]
---

# Remove a registered passkey. Requires a step-up proof. (Roles: user)

`DELETE /auth/2fa/webauthn/{credentialId}`

## Path parameters

- `credentialId` string, required

## Request body

- TwoFactorStepUpPayload — A fresh second-factor proof for a change to the second factors themselves. Exactly one field; an empty body is answered with error_payload.code STEP_UP_REQUIRED.
  - `totp_code` string
  - `recovery_code` string
  - `webauthn_assertion` object

## Response `200`

Success

- TwoFactorRemoveCredentialResponse
  - `disabled` boolean — True when this was the last passkey and no authenticator app was confirmed, so removing it turned two-factor authentication off entirely rather than leaving an unsatisfiable requirement.
  - `token` string — Present only when `disabled` is true.

## Other responses

- `400` — Error
- `404` — No such passkey on this account
- `429` — Too many failed second-factor attempts

## Changes

- **2026-09-01** `37a21589e770` — 1 info
  - endpoint added

[Change history](https://skmtc.dev/ludo/apis/ludo-ai-api/changes/auth/2fa/webauthn/:credentialId/delete.md)

---

[API](https://skmtc.dev/ludo/apis/ludo-ai-api.md) · [All operations](https://skmtc.dev/ludo/apis/ludo-ai-api/llms.txt) · [OpenAPI document](https://skmtc-service-production.skmtc.workers.dev/v1/apis/ludo/ludo-ai-api/revisions/8c2e600e07d4/schema)