Deleting passkeys from your backend and the user's local device

TL;DR

Passkeys are comprised of two components - a private element, which remains on the user’s device, and the public element, which is stored in your vault. You need to ensure both components remain in sync. Passlock offers tooling to help you do this.

Deleting a passkey from your vault

Use the @passlock/server library to remove a passkey from your vault:

Default (safe)

import { Passlock, isNotFoundError } from "@passlock/server";

// get these from your development tenancy settings
const tenancyId = "myTenancyId";
const apiKey = "myApiKey";
const passlock = new Passlock({ tenancyId, apiKey });

const result = await passlock.deletePasskey({ passkeyId });

if (result.success) {
  // success
} else if (isNotFoundError(result.error)) {
  // passkey not found in the vault
} else {
  console.error(result.error.message);
}

Unsafe

import { Passlock, isNotFoundError } from "@passlock/server/unsafe";

// get these from your development tenancy settings
const tenancyId = "myTenancyId";
const apiKey = "myApiKey";
const passlock = new Passlock({ tenancyId, apiKey });

try {
  const result = await passlock.deletePasskey({ passkeyId });
} catch (e) {
  if (isNotFoundError(e)) {
    // passkey not found in the vault
  }
}

Functions (safe)

import {
  deletePasskey,
  isNotFoundError
} from "@passlock/server";

// get these from your development tenancy settings
const tenancyId = "myTenancyId";
const apiKey = "myApiKey";

const result = await deletePasskey({ passkeyId }, { tenancyId, apiKey });

if (result.success) {
  // success
} else if (isNotFoundError(result.error)) {
  // passkey not found in the vault
} else {
  console.error(result.error.message);
}

Functions (unsafe)

import { deletePasskey, isNotFoundError } from "@passlock/server/unsafe";

// get these from your development tenancy settings
const tenancyId = "myTenancyId";
const apiKey = "myApiKey";

try {
  const result = await deletePasskey({ passkeyId }, { tenancyId, apiKey });
} catch (e) {
  if (isNotFoundError(e)) {
    // passkey not found in the vault
  }
}

Choose your code style

Deleting a passkey from a device

Use the @passlock/browser library to remove a passkey from a user’s device:

Default (safe)

import { Passlock } from "@passlock/browser";

// get this from your development tenancy settings
const tenancyId = "myTenancyId";
const passkeyId = "myPasskeyId";
const passlock = new Passlock({ tenancyId });

const result = await passlock.deletePasskey({ passkeyId });

if (result.success) {
  // happy days
} else {
  console.log(result.error.message);
}

Unsafe

import { Passlock, isDeleteError } from "@passlock/browser/unsafe";

// get this from your development tenancy settings
const tenancyId = "myTenancyId";
const passkeyId = "myPasskeyId";
const passlock = new Passlock({ tenancyId });

try {
  const result = await passlock.deletePasskey({ passkeyId });
} catch (e) {
  if (isDeleteError(e)) {
    console.log(e.message);
  }
}

Functions (safe)

import { deletePasskey } from "@passlock/browser";

// get this from your development tenancy settings
const tenancyId = "myTenancyId";
const passkeyId = "myPasskeyId";

const result = await deletePasskey({ passkeyId }, { tenancyId });

if (result.success) {
  // happy days
} else {
  console.log(result.error.message);
}

Functions (unsafe)

import { deletePasskey, isDeleteError } from "@passlock/browser/unsafe";

// get this from your development tenancy settings
const tenancyId = "myTenancyId";
const passkeyId = "myPasskeyId";

try {
  const result = await deletePasskey({ passkeyId }, { tenancyId });
} catch (e) {
  if (isDeleteError(e)) {
    console.log(e.message);
  }
}

Choose your code style

Tip

You can also delete a device passkey in response to an OrphanedPasskeyError, even if you don’t know the passkey ID. This scenario can occur when using autofill. See deletion following an orphaned passkey error

Backend and frontend deletion

You can first delete a passkey from your vault, then pass the result to your frontend code…

Default (safe)

import { Passlock } from "@passlock/server";

const passlock = new Passlock({ tenancyId, apiKey });
const result = await passlock.deletePasskey({ passkeyId });

if (result.success) {
  // send the DeletedPasskey payload to your frontend
  res.send(JSON.stringify(result.value));
}

Unsafe

import { Passlock } from "@passlock/server/unsafe";

const passlock = new Passlock({ tenancyId, apiKey });
const result = await passlock.deletePasskey({ passkeyId });

// send the DeletedPasskey payload to your frontend
res.send(JSON.stringify(result));

Functions (safe)

  import { deletePasskey } from "@passlock/server";

  const result = await deletePasskey({ passkeyId }, { tenancyId, apiKey });

  if (result.success) {
    // send the DeletedPasskey payload to your frontend
    res.send(JSON.stringify(result.value));
  }

Functions (unsafe)

import { deletePasskey } from "@passlock/server/unsafe";

const result = await deletePasskey({ passkeyId }, { tenancyId, apiKey });

// send the DeletedPasskey payload to your frontend
res.send(JSON.stringify(result));

Choose your code style

Default (safe)

import { Passlock } from "@passlock/browser";

const passlock = new Passlock({ tenancyId });

// result of calling deletePasskey in your backend
const backendDeletionResult = {
  deleted: { credentialId: "...", userId: "...", rpId: "..." },
};

const result = await passlock.deletePasskey(backendDeletionResult.deleted);

if (!result.success) {
  console.error(result.error.message);
}

Unsafe

import { Passlock } from "@passlock/browser/unsafe";

const passlock = new Passlock({ tenancyId });

// result of calling deletePasskey in your backend
const backendDeletionResult = {
  deleted: { credentialId: "...", userId: "...", rpId: "..." },
};

try {
  const result = await passlock.deletePasskey(backendDeletionResult.deleted);
} catch (e) { ... }

Functions (safe)

import { deletePasskey } from "@passlock/browser";

// result of calling deletePasskey in your backend
const backendDeletionResult = {
  deleted: { credentialId: "...", userId: "...", rpId: "..." },
};

const result = await deletePasskey(backendDeletionResult.deleted);

if (!result.success) {
  console.error(result.error.message);
}

Functions (unsafe)

import { deletePasskey } from "@passlock/browser/unsafe";

// result of calling deletePasskey in your backend
const backendDeletionResult = {
  deleted: { credentialId: "...", userId: "...", rpId: "..." },
};

try {
  const result = await deletePasskey(backendDeletionResult.deleted);
} catch (e) { ... }

Choose your code style

Tip

This is more efficient because when you call deletePasskey({ passkeyId }, { tenancyId }) in frontend code, the @passlock/browser library first needs to lookup metadata to pass to the device. The backend deletion result already includes this metadata.

Handling an OrphanedPasskeyError

During client side authentication, if you receive an OrphanedPasskeyError, pass that error into the deletePasskey function:

Default (safe)

import {
  Passlock,
  isOrphanedPasskeyError,
} from "@passlock/browser";

const passlock = new Passlock({ tenancyId });
const result = await passlock.authenticatePasskey(options);

if (result.failure && isOrphanedPasskeyError(result.error)) {
  if (confirm("Passkey invalid, remove it?")) {
    const deletion = await passlock.deletePasskey(result.error);

    if (!deletion.success) {
      console.error(deletion.error.message);
    }
  }
} else if (!result.success) {
  console.error(result.error.message);
}

Unsafe

import {
  Passlock,
  isOrphanedPasskeyError,
} from "@passlock/browser/unsafe";

const passlock = new Passlock({ tenancyId });

try {
  const result = await passlock.authenticatePasskey(options);
} catch (e) {
  if (isOrphanedPasskeyError(e)) {
    if (confirm("Passkey invalid, remove it?")) {
      await passlock.deletePasskey(e);
    }
  }
}

Functions (safe)

import {
  authenticatePasskey,
  deletePasskey,
  isOrphanedPasskeyError,
} from "@passlock/browser";

const result = await authenticatePasskey(options, { tenancyId });

if (result.failure && isOrphanedPasskeyError(result.error)) {
  if (confirm("Passkey invalid, remove it?")) {
    const deletion = await deletePasskey(result.error);

    if (!deletion.success) {
      console.error(deletion.error.message);
    }
  }
} else if (!result.success) {
  console.error(result.error.message);
}

Functions (unsafe)

import {
  authenticatePasskey,
  deletePasskey,
  isOrphanedPasskeyError,
} from "@passlock/browser/unsafe";

try {
  const result = await authenticatePasskey(options, { tenancyId });
} catch (e) {
  if (isOrphanedPasskeyError(e)) {
    if (confirm("Passkey invalid, remove it?")) {
      await deletePasskey(e);
    }
  }
}

Choose your code style

Note

Programmatic passkey removal is an experimental feature that some browsers don’t yet support (as of February 2026). However it is gaining traction so it’s worth testing for it and using if supported.