# Rename a passkey

`PATCH /fapi/v1/me/passkeys/{authenticator_id}` · called from the environment's sign-in host

Changes the display name the user gave to a passkey record. Requires the authenticated user's `__Host-idp_session` cookie; if the cookie is missing, expired, or revoked, returns `401 unauthenticated`. A first-party app on another origin can instead send its front API access token (`Authorization: DPoP <token>` with a DPoP proof; see [Front API access token](/docs/api/fapi/front-api-token)).

## Request

Headers:

| Header | Required | Description |
| --- | --- | --- |
| `Idp-Client` | yes | SDK identifier. |
| `Origin` | yes | Must be exactly `https://<sign-in host>`. |

Body:

```json
{"label": "Work laptop"}
```

`label` is required; cannot contain control characters or directional markers.

## Response

`204 No Content`.

## Errors

| Status | Code | When |
| --- | --- | --- |
| 422 | `validation_failed` | `label` missing. |
| 422 | `invalid_display_string` | `label` does not comply with display name rules. |
| 401 | `unauthenticated` | No valid session cookie. |
| 403 | `origin_not_allowed` | `Origin` is missing or wrong. |
| 404 | `not_found` | No such passkey or security key for this user. |

## Example

```bash
curl -X PATCH https://example.keenauth.app/fapi/v1/me/passkeys/cred_01j9zzzzzzzzzzzzzzzzzzzzzz \
  -H "Idp-Client: my-app/1.0.0 (node/22.0.0)" \
  -H "Origin: https://example.keenauth.app" \
  -H "Content-Type: application/json" \
  -d '{"label": "Work laptop"}' \
  -b cookies.txt
```

## Personal data

This endpoint carries personal data: credentials. [Personal data in the KeenAuth APIs](/docs/policies/personal-data) describes what is stored, how long it is kept and how it is deleted. Do not send special categories of personal data (health, biometric data, religion, political opinions, sexual orientation) in any field.