---
title: "Remove one of the signed-in user's passkeys"
method: POST
path: "/auth/account/passkeys/remove"
tags: ["Auth"]
---

# Remove one of the signed-in user's passkeys

`POST /auth/account/passkeys/remove`

## Request

- Base URL: `https://api.run402.com`
- URL: `https://api.run402.com/auth/account/passkeys/remove`
- Auth: API key in cookie `__Host-Http-r402_session`

Hosted browser-session route (cookie + double-submit CSRF + same-origin), freshness-gated (5-min step-up). User-scoped soft delete. Allow + warn: if removal leaves no Run402 password AND no remaining passkeys, the response carries a warning. To ADD a passkey use POST /auth/passkeys/register/{options,verify}.

## Request body

- object
  - `passkey_id` string, required

## Response `200`

{ ok, removed, warning }

- object

## Other responses

- `401`: Missing or invalid authentication. Run402-originated JSON bodies use the canonical ErrorEnvelope.

---

[API](https://skmtc.dev/run402/apis/run402-api.md) · [All operations](https://skmtc.dev/run402/apis/run402-api/llms.txt) · [OpenAPI document](https://skmtc.dev/run402/apis/run402-api/revisions/893607557f50?raw)