> ## Documentation Index
> Fetch the complete documentation index at: https://docs.authsignal.com/llms.txt
> Use this file to discover all available pages before exploring further.

# authenticator.expired

> Fired when an authenticator expires and is removed from a user.

Fired when a credential with a configured [credential lifetime](/authentication-methods/app-verification/enrollment-lifecycle#keeping-credentials-alive) passes its expiry and is removed. The expired credential is excluded from challenges as soon as its expiry passes; this webhook confirms its removal. `authenticator.deleted` is not sent when a credential expires.

<Warning>
  This webhook can arrive up to 24 hours after the credential expires. Expiry itself is enforced
  immediately - an expired credential can't be used to verify, and `getCredential` returns no
  credential - so treat this event as a notification, not as the moment of expiry. The `expiresAt`
  field carries the actual expiry time.
</Warning>

This webhook is asynchronous. If your endpoint returns a non-2xx response, it is retried up to 3 times, at least 30 seconds apart.

Configure the webhook URL for authenticator events in [tenant settings](https://portal.authsignal.com/organisations/tenants/settings).

## Payload

<ParamField path="userId" type="string" required>
  The ID of the user the authenticator expired for.
</ParamField>

<ParamField path="verificationMethod" type="string" required>
  The verification method of the authenticator that expired.
</ParamField>

<ParamField path="createdAt" type="string" required>
  The time the authenticator was originally created in ISO 8601 format.
</ParamField>

<ParamField path="expiresAt" type="string" required>
  The time the authenticator expired in ISO 8601 format. This can be earlier than the webhook
  delivery time.
</ParamField>

<ParamField path="userAuthenticatorId" type="string" required>
  A unique ID for the user authenticator that expired.
</ParamField>

<ParamField path="deviceName" type="string">
  A display name for the device the credential belonged to. Only included when the device provided
  one at enrollment.
</ParamField>

<ParamField path="devicePlatform" type="string">
  The platform of the device the credential belonged to, such as `IOS` or `ANDROID`. Only included
  when the device provided one at enrollment.
</ParamField>

<ParamField path="email" type="string">
  The email address associated with the authenticator. Included for email OTP and magic link
  authenticators.
</ParamField>

<ParamField path="phoneNumber" type="string">
  The phone number associated with the authenticator. Included for SMS and WhatsApp authenticators.
</ParamField>

<ParamField path="credentialId" type="string">
  The passkey credential ID. Only included for passkey authenticators.
</ParamField>

<ParamField path="aaguid" type="string">
  The AAGUID of the authenticator that created the passkey. Only included for passkey
  authenticators.
</ParamField>

<ParamField path="credentialName" type="string">
  A display name for the passkey authenticator, such as the device or credential manager name. Only
  included for passkey authenticators.
</ParamField>

<ResponseExample>
  ```json authenticator.expired theme={null}
  {
    "version": 1,
    "id": "ffffffff-ffff-ffff-ffff-ffffffffffff",
    "source": "https://authsignal.com",
    "time": "2025-01-01T14:34:56.789Z",
    "tenantId": "dddddddd-dddd-dddd-dddd-dddddddddddd",
    "type": "authenticator.expired",
    "data": {
      "userId": "11111111-1111-1111-1111-111111111111",
      "verificationMethod": "PUSH",
      "createdAt": "2024-01-01T01:23:45.678Z",
      "expiresAt": "2025-01-01T02:34:56.000Z",
      "userAuthenticatorId": "cccccccc-cccc-cccc-cccc-cccccccccccc",
      "deviceName": "iPhone 16 Pro",
      "devicePlatform": "IOS"
    }
  }
  ```
</ResponseExample>