# List my passkeys and security keys

`GET /fapi/v1/me/passkeys` · called from the environment's sign-in host

Lists the authenticated user's registered passkeys and security keys. Returns only `passkey` and `security_key` types. Requires the authenticated user's `__Host-idp_session` cookie; if the cookie is missing, expired, or revoked, returns `401 unauthenticated`. A first-party app on another origin can instead send its front API access token (`Authorization: DPoP <token>` with a DPoP proof; see [Front API access token](/docs/api/fapi/front-api-token)).

## Request

Headers:

| Header | Required | Description |
| --- | --- | --- |
| `Idp-Client` | yes | SDK identifier. |

No body.

## Response

`200 OK` with `{"data": [...]}`.

Each item: `id` (`cred_…`), `type` (`passkey`, `security_key`, `totp`, `sms`, `email`, `push`), `label`, `status` (`active` or `clone_suspected`: signature counter went backward, unusable until confirmed), `synced` (synced passkey), `created_at`, `last_used_at` (`null` if never used), `last_used_country` (if present).

## Errors

| Status | Code | When |
| --- | --- | --- |
| 401 | `unauthenticated` | No valid session cookie. |

## Example

```bash
curl https://example.keenauth.app/fapi/v1/me/passkeys \
  -H "Idp-Client: my-app/1.0.0 (node/22.0.0)" \
  -b cookies.txt
```

## Personal data

This endpoint carries personal data: credentials. [Personal data in the KeenAuth APIs](/docs/policies/personal-data) describes what is stored, how long it is kept and how it is deleted. Do not send special categories of personal data (health, biometric data, religion, political opinions, sexual orientation) in any field.