---
title: "Delete"
method: DELETE
path: "/users/me/passkeys/{id}"
tags: ["Users"]
---

# Delete

`DELETE /users/me/passkeys/{id}`

Deletes one of the authenticated user's own passkeys. The request body carries a WebAuthn assertion from the passkey being deleted, so possession of the credential is proven before it is removed: mint a `deletion` challenge for it first, run the ceremony with that passkey, and send the result here. Deleting the user's last passkey is allowed — their other step-up factors remain. Requires a user session.

## Request body

- object
  - `authenticator_data` string, required — The `authenticatorData` from the WebAuthn assertion, base64url-encoded.
  - `client_data_json` string, required — The `clientDataJSON` from the WebAuthn assertion, base64url-encoded.
  - `signature` string, required — The `signature` from the WebAuthn assertion, base64url-encoded.

## Response `200`

passkey deleted

- object
  - `deleted` boolean, required — Always `true`: the passkey was removed.
  - `id` string, required — The ID of the deleted passkey.

## Other responses

- `400` — Invalid Parameters
- `401` — Unauthorized
- `403` — Forbidden
- `404` — Resource not found

## Changes

- **2026-08-07** `f1020c3ecda4` — 4 info
  - added the optional property `error/code` to the response with the `400` status
  - added the optional property `error/code` to the response with the `401` status
  - added the optional property `error/code` to the response with the `403` status
  - added the optional property `error/code` to the response with the `404` status
- **2026-07-31** `099fdc3be422` — 1 info
  - endpoint added

[Change history](https://skmtc.dev/whop/apis/whop-api/changes/users/me/passkeys/:id/delete.md)

---

[API](https://skmtc.dev/whop/apis/whop-api.md) · [All operations](https://skmtc.dev/whop/apis/whop-api/llms.txt) · [OpenAPI document](https://skmtc-service-production.skmtc.workers.dev/v1/apis/whop/whop-api/revisions/9e320991dd2f/schema)