Authenticator management

FIDO authenticator credentials accumulate as users register devices. The authenticator admin API enables you to manage these credentials throughout their lifecycle.

The authenticator admin API provides operations for managing FIDO credentials throughout their lifecycle.

The authenticator admin API allows you to:

• List authenticators: Retrieve all credentials for a specific user or device.
• Get authenticator: Retrieve detailed information about a specific credential.
• Update authenticator: Modify credential properties such as friendly names or status.
• Delete authenticator: Remove a specific credential.
• Delete authenticators: Remove multiple credentials based on search criteria.
• Delete DBK binding: Remove a specific device-bound key binding from a credential.

Authenticator information

Device-bound key information

When an authenticator has associated device-bound keys, the dbk array in the authenticator information response lists all keys bound to the authenticator, with the most recently used key listed first:

{
    "dbk": [
        {
            "kid": "dbk_kid_123",
            "lastUsedDateTime": "2026-01-15T10:30:00Z"
        },
        {
            "kid": "dbk_kid_456",
            "lastUsedDateTime": "2026-02-20T08:00:00Z"
        }
    ]
}

Each entry contains:

• kid — the key identifier of the device-bound key
• lastUsedDateTime — the date and time the key was last used for authentication

Authenticator lockout information

When an authenticator lockout policy is configured, the authenticator info response includes the following lockout-related fields:

• failCounter — number of consecutive failed authentication attempts for this authenticator
• failWindowExpiresAtTs — the date and time when the current failure tracking window expires
• blockedUntilTs — the date and time until which the authenticator is locked out (present only when the authenticator is currently blocked)

Example response when an authenticator is locked out:

{
    "failCounter": 5,
    "failWindowExpiresAtTs": "2026-04-28T14:00:00Z",
    "blockedUntilTs": "2026-04-28T15:00:00Z"
}

Authenticator status lifecycle

Each authenticator credential has a status that reflects its current state:

Updating authenticator status

You can change an authenticator's status using the update authenticator operation. Only the following status transitions are allowed via the admin API:

• Set to ACTIVE: Re-activate a suspended authenticator.
• Set to SUSPENDED: Suspend an active authenticator to prevent its use.

Example request to reactivate a suspended authenticator:

{
    "status": "ACTIVE"
}

Deleting a specific device-bound key binding

To remove a specific device-bound key from an authenticator without deleting the authenticator itself, use the delete DBK binding endpoint:

DELETE /authenticators/{credId}/dbk/{dbkKid}

This removes the association between the authenticator and the specified DBK. If this was the last authenticator using the DBK, the DBK public key is also deleted. The authenticator itself remains intact.

Required parameters:

• credId — the credential ID of the authenticator (Base64URL encoded)
• dbkKid — the key identifier (kid) of the device-bound key binding to delete
• userId or username — the identifier of the user who owns the authenticator

This operation requires the fido2_server-authenticator_delete_dbk role.

Example:

DELETE /authenticators/h_0I4nKMO0wwXZRlK.../dbk/dbk_kid_123?userId=VTBUODQwMC1lMjli...

Authentication and authorization

All authenticator admin API operations require proper authentication:

• Operations require specific roles encoded in the JWT token passed as an HTTP Authorization request header with the Bearer authorization scheme.
• Each operation specifies the required role in its API documentation.

Next steps

• Review the authenticator admin API reference for detailed endpoint documentation.
• Learn about user management.
• Explore policy management.