Rename a registered passkey
Lets the user distinguish 'MacBook Touch ID' from 'iPhone Face ID' in the authenticators list. Scoped by `(credentialID, userId)` so a credentialID leak can't let another user rename the passkey.
/api/user/passkeys/{credentialId}Lets the user distinguish 'MacBook Touch ID' from 'iPhone Face ID' in the authenticators list. Scoped by (credentialID, userId) so a credentialID leak can't let another user rename the passkey.
Path Parameters
WebAuthn credential id (base64url string)
Request Body
application/json
TypeScript Definitions
Use the request body type in TypeScript.
Response Body
curl -X PATCH "https://loading/api/user/passkeys/string" \ -H "Content-Type: application/json" \ -d '{ "name": "iPhone Face ID" }'Unlink a linked OAuth account DELETE
Only unlinks the local `Account` row — does NOT revoke the provider-side consent (users manage that in Google / GitHub settings). Last-login-method guard runs in a `Serializable` transaction: counts remaining OAuth accounts + passkeys + email-OTP availability AFTER the hypothetical unlink. If zero would remain, returns `409` and the row is preserved — prevents single-click lockout.
Unregister a passkey DELETE
Same `(credentialID, userId)` scoping as rename. The account stays usable via other authenticators (OAuth, OTP) as long as at least one remains — there's no equivalent to the OAuth last-method guard here because passkey removal alone never strands a user.