---
title: "Remove a passkey from the current user"
method: POST
path: "/auth/security/passkeys/{passkey_id}/remove"
tags: ["Auth"]
---

# Remove a passkey from the current user

`POST /auth/security/passkeys/{passkey_id}/remove`

## Request

- Base URL: `https://app.openpo.st/api/v1`
- URL: `https://app.openpo.st/api/v1/auth/security/passkeys/{passkey_id}/remove`
- Auth: one of:
  - HTTP bearer
  - API key in cookie `openpost_session`

## Path parameters

- `passkey_id` string, required: Passkey ID

## Request body

- RemovePasskeyInputBody
  - `$schema` string, uri: A URL to the JSON Schema for this object.
  - `current_password` string, required: Current password for re-authentication
  - `reauth_grant` string: One-time action-bound reauthentication grant

## Response `200`

OK

- SecurityStatusOutputBody
  - `$schema` string, uri: A URL to the JSON Schema for this object.
  - `methods` string[], nullable, required: Currently available MFA methods
  - `passkeys` PasskeySummary[], nullable, required
    - `created_at` string, date-time, required: When the passkey was registered
    - `id` string, required: Passkey ID
    - `last_used_at` string, date-time, required: When the passkey was last used
    - `name` string, required: User-visible passkey label
  - `totp_enabled` boolean, required: Whether authenticator-based 2FA is enabled
  - `user` UserProfile, required
    - `$schema` string, uri: A URL to the JSON Schema for this object.
    - `avatar_url` string, required: Profile avatar URL
    - `composer_experience` 'specialized' | 'unified', required: Preferred composer experience
    - `created_at` string, date-time, required: Account creation time
    - `display_name` string, required: User display name
    - `email` string, required: User email address
    - `email_verified` boolean, required: Whether the account email address is verified
    - `has_password` boolean, required: Whether this account has a local password credential
    - `id` string, required: User ID
    - `is_admin` boolean, required: Whether this user can manage instance-level settings
    - `is_managed` boolean, required: Whether this account was provisioned by an organization identity provider
    - `legal_acceptance_required` boolean, required: Whether the current hosted policy still needs acceptance
    - `legal_accepted_at` string, date-time: When the current account policy was accepted
    - `managed_organization_name` string: Organization managing this account
    - `password_usable` boolean, required: Whether the local password can currently be used for sign-in and sensitive-action reauthentication
    - `privacy_version` string: Privacy version acknowledged by the user
    - `public_profile_enabled` boolean, required: Whether the public activity profile is visible
    - `public_profile_visible_fields` string[], nullable, required: Optional account fields visible while the public profile is enabled
    - `terms_version` string: Terms version accepted by the user
    - `username` string, required: Unique public username

## Other responses

- `400`: Bad Request
- `401`: Unauthorized
- `404`: Not Found
- `422`: Unprocessable Entity
- `429`: Too Many Requests
- `500`: Internal Server Error

---

[API](https://skmtc.dev/openpo/apis/openpost-api.md) · [All operations](https://skmtc.dev/openpo/apis/openpost-api/llms.txt) · [OpenAPI document](https://skmtc.dev/openpo/apis/openpost-api/revisions/67d3964458a7?raw)