Skip to content

Authenticator Removal Would Lock Out

URI: https://docs.ankatech.co/errors/authenticator-removal-would-lock-out
HTTP Status: 409 Conflict

When you see this

A person asked to remove one of their own authenticators — a passkey, the authenticator app, or the password — and removing it would leave them unable to sign in somewhere they are a member. Nothing was removed.

Authenticators belong to the person's identity and serve every tenant they are a member of. Each active membership is governed by its tenant's authentication policy (which mechanisms it admits, and which passkey properties it requires), and a platform administrator signs in with a passkey or with password + TOTP, as the platform posture admits. The removal is refused when, without the authenticator, at least one active membership, or a platform administrator's platform plane, would have no admissible way left to sign in.

The answer names no tenant and no membership. The person's other memberships are not something this answer discloses.

Common Causes

  • Removing the only passkey of a platform administrator who holds no authenticator app (one who holds the password and an authenticator app may remove it).
  • Removing the only passkey while a tenant the person belongs to admits passkeys only.
  • Removing the passkey that alone carries a property a tenant requires (for example a hardware-backed, attested passkey).
  • Removing the authenticator app, or the password, while a tenant the person belongs to admits sign-in only with password and authenticator app and the person holds no passkey meeting its policy.

Response Example

{
  "type": "https://docs.ankatech.co/errors/authenticator-removal-would-lock-out",
  "title": "Authenticator Removal Would Lock Out",
  "status": 409,
  "detail": "Removing this authenticator would leave no way to sign in to one of your memberships. Add another authenticator first.",
  "instance": "/api/v3/auth/account/authenticators/6a1f3c9e-2b7d-4e58-9c04-8d2e5f1a7b36",
  "timestamp": 1730000000
}

Content-Type: application/problem+json — the response follows RFC 9457 Problem Details. This is an Auth API body, so it carries no correlation member: correlate through the X-Correlation-Id response header. See Error Index & Overview.

How to Resolve

  1. Add another authenticator that every one of your memberships admits — for most people, a second passkey on a separate device or security key.
  2. Remove the original authenticator again.
  3. A platform administrator always keeps a way to sign in locally: a passkey, or the password and an authenticator app. Register a replacement passkey, or set up an authenticator app, before removing the last passkey.

For full schema definitions, examples, and interactive testing, see the Developer Hub Reference.