Unlink a linked OAuth account
Only unlinks the local `Account` row — does NOT revoke the provider-side consent (users manage that in Google / GitHub settings). Last-login-method guard runs in a `Serializable` transaction: counts remaining OAuth accounts + passkeys + email-OTP availability AFTER the hypothetical unlink. If zero would remain, returns `409` and the row is preserved — prevents single-click lockout.
/api/user/accounts/{provider}Only unlinks the local Account row — does NOT revoke the provider-side consent (users manage that in Google / GitHub settings). Last-login-method guard runs in a Serializable transaction: counts remaining OAuth accounts + passkeys + email-OTP availability AFTER the hypothetical unlink. If zero would remain, returns 409 and the row is preserved — prevents single-click lockout.
Path Parameters
OAuth provider name (google, github, etc.)
Response Body
curl -X DELETE "https://loading/api/user/accounts/string"Update the user's UI locale preference PATCH
Validates against the canonical `LOCALES` tuple. The session refresh + URL prefix swap happen client-side: on `204` the client calls `session.update({})` to force a JWT refresh, then `router.replace(pathname, { locale })` to swap the URL. All three steps are sequenced inside `useUpdateLocaleMutation.onSuccess`.
Rename a registered passkey PATCH
Lets the user distinguish 'MacBook Touch ID' from 'iPhone Face ID' in the authenticators list. Scoped by `(credentialID, userId)` so a credentialID leak can't let another user rename the passkey.