Delete a passkey

Your users might want to delete their passkeys. You can do this using the @passlock/browser and @passlock/server libraries. For deletion, we flip the order of operations, although strictly this is not required:

1. Unlink the passkey from the user’s account (backend)
2. Prepare deletion in Passlock, which removes it from your vault and returns a browser token (backend)
3. Pass that token to the user’s passkey manager (frontend)

Tip

You can also handle stale local passkeys during an authentication operation. See the full passkey deletion and handling missing passkeys guides for more information.

Backend: delete the passkey

Use the @passlock/server library to delete the passkey from your vault:

backend/delete-passkey.ts

import { Passlock } from "@passlock/server";

// from your development tenancy settings
const passlock = new Passlock({
  tenancyId: "myTenancyId",
  apiKey: "myApiKey"
});

// remove the passkey from your Passlock vault
const result = await passlock.deletePasskeys({
  passkeyIds: [passkeyId],
});

if (result.success) {
  // remove the mapping between the passkey and your local user account
  await unlinkPasskey({ passkeyId });

  return {
    deletePasskeysToken: result.value.deletePasskeysToken,
  };
} else {
  console.error(result.error.message);
}

Frontend: delete the passkey on the device

Use the @passlock/browser library to delete the passkey from the user’s device.

frontend/delete-passkey.ts

import { Passlock } from "@passlock/browser";

const passlock = new Passlock({ tenancyId: "myTenancyId" });

const { deletePasskeysToken } = await fetchPreparedPasskeyDeletion();

const result = await passlock.deletePasskeys({ deletePasskeysToken });

if (result.success) {
  console.log(result.value.warnings);
} else {
  console.error(result.error.message);
  alert("Please remove your jdoe@example.com passkey");
}

Alternative: Using the REST API

If you cannot use @passlock/server, prepare the deletion using the v2 REST endpoint:

POST /v2/{tenancyId}/passkeys/delete HTTP/1.1
Host: api.passlock.dev
Accept: application/json
Authorization: Bearer {apiKey}
Content-Type: application/json

{
  "passkeyIds": ["passkey_123"]
}