View, revoke and delete users and passkeys

Find a user

1. Open an environment of the project and click "Users" in the menu.
2. Search by external_id (or part of it).
3. If needed, choose "Registration completed" or "Registration not completed" in the "All users" filter.

The list shows the external_id, display name, number of active passkeys and last login, 100 at a time, most recently registered first. Click "Next 100" below the list to see more and "First page" to go back. If you know who you are looking for, search by external_id.

• Users who started passkey registration but did not finish it (they closed the registration screen or it failed) show "Registration not completed" in the active passkeys column.
• Users whose passkeys were all revoked did complete registration and show 0 active passkeys.

View a user's passkeys

Click an external_id to open the user. It shows the user ID and, for each passkey, the name, type (transports and whether it is synced), last used and registered date. Revoked passkeys show when they were revoked.

Revoke one passkey

1. On the user page, open the menu on the passkey's row.
2. Choose "Revoke" and click "Revoke" in the confirmation dialog.

The revoked passkey can no longer be used to log in. This cannot be undone.

Revoke all passkeys

1. Click "Revoke all" at the bottom of the user page.
2. Click "Revoke all" in the confirmation dialog.

Use this when you suspect an account takeover. The user and the audit log are kept. To use passkeys again, the user registers again through recovery.

Delete a user

1. Click "Delete user" at the bottom of the user page.
2. Enter the user's ID (external_id) to confirm, and click "Delete".

• Passkeys, the display name and recovery tokens are deleted, and the user's details in the audit log are masked (for account closure or personal data deletion requests). This cannot be undone.
• Registering again with the same ID creates a different user.

Actions not available in the dashboard

The following are not in the dashboard. Use the API or MCP.

A recovery token is valid for 15 minutes. Verify the user's identity in your service before issuing one. See Recovery in the API reference.

Who can do this

Developers, Admins and Owners can revoke passkeys; Admins and Owners can delete users. These actions are recorded in the audit log and sent to your webhook if one is set.