Unregister a passkey
Same `(credentialID, userId)` scoping as rename. The account stays usable via other authenticators (OAuth, OTP) as long as at least one remains — there's no equivalent to the OAuth last-method guard here because passkey removal alone never strands a user.
/api/user/passkeys/{credentialId}Same (credentialID, userId) scoping as rename. The account stays usable via other authenticators (OAuth, OTP) as long as at least one remains — there's no equivalent to the OAuth last-method guard here because passkey removal alone never strands a user.
Path Parameters
WebAuthn credential id (base64url string)
Response Body
curl -X DELETE "https://loading/api/user/passkeys/string"Rename a registered passkey PATCH
Lets the user distinguish 'MacBook Touch ID' from 'iPhone Face ID' in the authenticators list. Scoped by `(credentialID, userId)` so a credentialID leak can't let another user rename the passkey.
List pending invites addressed to the caller's email GET
Lazy expiry — past-TTL rows are filtered out and status-flipped to `EXPIRED` in the background. The daily cron hard-deletes past-TTL rows overnight; this keeps the schema clean between runs without an extra scheduled job.