---
title: "Rename Passkey"
method: PATCH
path: "/v1/auth/webauthn/credentials/{credential_id}"
tags: ["auth"]
---

# Rename Passkey

`PATCH /v1/auth/webauthn/credentials/{credential_id}`

Relabel one of the caller's passkeys, which is all that is editable.

Ungated like the list, and for the same reason: naming an orphan before
deleting it is not something a lost relying-party ID should prevent.

## Path parameters

- `credential_id` string, uuid, required

## Request body

- WebAuthnCredentialUpdate — Renaming a passkey, which is the only thing about one that is editable. Everything else on the row is what the authenticator asserted, so there is nothing else a person could correct.
  - `name` string, required

## Response `200`

Successful Response

- WebAuthnCredentialPublic — A passkey as the settings page lists it. Carries no key material. ``credential_id`` is here because the browser needs it to tell the passkey it just used from the others in the list, and it is a public identifier the authenticator hands to any site that asks: it is what ``allowCredentials`` publishes to an unauthenticated caller during a ceremony.
  - `backed_up` boolean, required
  - `created_at` string, date-time, required
  - `credential_id` string, required
  - `id` string, uuid, required
  - `is_usable` boolean, required
  - `last_used_at` string, date-time, nullable, required
  - `name` string, required
  - `rp_id` string, required
  - `transports` string[], required

## Other responses

- `422` — Validation Error

## Changes

- **2026-08-24** `bd0edfaa8297` — 1 info
  - endpoint added

[Change history](https://skmtc.dev/mozilla-ai/apis/otari/changes/v1/auth/webauthn/credentials/:credential_id/patch.md)

---

[API](https://skmtc.dev/mozilla-ai/apis/otari.md) · [All operations](https://skmtc.dev/mozilla-ai/apis/otari/llms.txt) · [OpenAPI document](https://skmtc-service-production.skmtc.workers.dev/v1/apis/mozilla-ai/otari/revisions/7f178e92b56c/schema)