Skip to content
AetherAether Docs

List the current account's passkeys

GET
/v1/mfa/passkeys
curl --request GET \
  --url https://api.aetherpush.com/v1/mfa/passkeys \
  --header 'Authorization: Bearer <token>'

Session-only. Returns the account’s passkeys together with the MFA state, the number of unused recovery codes, and the two-factor setup deadline the dashboard enforces.

Authorizations

Section titled “Authorizations”

Responses

Section titled “Responses”

200

Section titled “200”

Passkeys, MFA state, and remaining recovery codes.

Media typeapplication/json
object
passkeys
required
Array<object>
object
id
required
string format: uuid
name
required
string
deviceType

singleDevice or multiDevice, as reported at registration.

string | null
backedUp
required
boolean
transports
required
Array<string>
createdAt
string format: date-time
lastUsedAt
string | null format: date-time
mfaEnabled
required
boolean
remainingRecoveryCodes
required
integer
totpEnabled
required

Whether a confirmed authenticator app is set up.

boolean
mfaSetupDeadline

When this account must have two-factor authentication set up, in epoch milliseconds. Null until a first password login stamps it. The dashboard reads this rather than its own session storage, so the deadline survives a new tab.

integer | null format: int64
mfaSetupOverdue

The server’s own verdict on the deadline, so the dashboard does not have to compare timestamps against a client clock.

boolean
Examplegenerated
{
  "passkeys": [
    {
      "id": "2489E9AD-2EE2-8E00-8EC9-32D5F69181C0",
      "name": "example",
      "deviceType": "example",
      "backedUp": true,
      "transports": [
        "example"
      ],
      "createdAt": "2026-04-15T12:00:00Z",
      "lastUsedAt": "2026-04-15T12:00:00Z"
    }
  ],
  "mfaEnabled": true,
  "remainingRecoveryCodes": 1,
  "totpEnabled": true,
  "mfaSetupDeadline": 1,
  "mfaSetupOverdue": true
}

401

Section titled “401”

Authentication required.

Media typeapplication/json
object
error
required

Human-readable error message.

string
requestId

Unique identifier for the request, also exposed as the X-Request-Id response header.

string
Example
{
  "error": "The requested resource was not found.",
  "requestId": "req_abc123"
}

403

Section titled “403”

API keys and named access keys cannot manage passkeys; a login session is required.

Media typeapplication/json
object
error
required

Human-readable error message.

string
requestId

Unique identifier for the request, also exposed as the X-Request-Id response header.

string
Example
{
  "error": "The requested resource was not found.",
  "requestId": "req_abc123"
}