---
title: "Listcredentials"
method: GET
path: "/v1/webauthn/credentials/{user_id}/{domain}"
tags: ["Webauthn"]
---

# Listcredentials

`GET /v1/webauthn/credentials/{user_id}/{domain}`

## Request

- Base URL: `https://api.stytch.com`
- URL: `https://api.stytch.com/v1/webauthn/credentials/{user_id}/{domain}`
- Auth: HTTP basic

List the public key credentials of the WebAuthn Registrations or Passkeys registered to a specific User.

## Path parameters

- `user_id` string, required: The `user_id` of an active user the Passkey or WebAuthn registration should be tied to.
- `domain` string, required: The domain for Passkeys or WebAuthn. Defaults to `window.location.hostname`.

## Response `200`

Successful response

- ApiWebauthnV1ListCredentialsResponse
  - `credentials` ApiWebauthnV1WebAuthnCredential[], required: A list of WebAuthn credential objects.
    - `credential_id` string, required: The unique, public ID of the WebAuthn credential.
    - `webauthn_registration_id` string, required: The unique ID for the Passkey or WebAuthn registration.
    - `type` string, required: The type of the WebAuthn credential. Examples include `public-key`.
    - `public_key` string, required: The public key for the WebAuthn credential in base64 format.
  - `request_id` string, required: Globally unique UUID that is returned with every API call. This value is important to log for debugging purposes; we may ask for this value to help identify a specific API call when helping you debug an issue.
  - `status_code` integer, required: The HTTP status code of the response. Stytch follows standard HTTP response status code patterns, e.g. 2XX values equate to success, 3XX values are redirects, 4XX are client errors, and 5XX are server errors.

## Other responses

- `400`: Bad request
- `401`: Unauthorized
- `429`: Too Many Requests
- `500`: Internal server error

## Changes

- **2026-03-07** `110f26a94e5b`: 1 info
  - endpoint added
- **2026-03-06** `9cab20b8eca7`: 1 breaking
  - api path removed without deprecation
- **2025-09-17** `8270cf3a3d4c`: 3 info
  - added the media type `application/json` for the response with the status `401`
  - added the media type `application/json` for the response with the status `500`
  - added the non-success response with the status `429`
- **2025-09-17** `864b9f438ac0`: 1 breaking
  - the `status_code` response's property type changed from `string` to `integer`, and format from no format to `int32` for status `200`

[Operation history](https://skmtc.dev/stytch/apis/stytch-api/changes/v1/webauthn/credentials/:user_id/:domain/get.md)

---

[API](https://skmtc.dev/stytch/apis/stytch-api.md) - [All operations](https://skmtc.dev/stytch/apis/stytch-api/llms.txt) - [OpenAPI document](https://skmtc.dev/stytch/apis/stytch-api/revisions/6d1ff7474803?raw)