- Switching to a new device or authenticator app
- No longer having access to an email or phone number
- Simplifying their authentication setup
Implementation steps
1. Backend: Track action with settings redirect PassingredirectToSettings: true in the track request will mean that after completing a challenge with an existing authentication method, users will be redirected to a settings menu where they can remove authentication methods.
- Complete a challenge with one of their existing authenticators
- Access the settings menu where they can view all their enrolled methods
- Remove unwanted authenticators

Removing authentication methods in the pre-built UI
The pre-built UI automatically enforces security by requiring authentication before allowing
removal. Users cannot remove their last remaining authenticator to prevent account lockout.
Preventing removal of the last passkey
By default, users can remove their only passkey if they have another authentication method. To stop this, turn on Prevent removing last passkey in the advanced settings of the passkey authenticator. You can also setpreventRemovingLastPasskey with the Management API.
When the setting is on, the pre-built UI doesn’t offer to remove the user’s last passkey, and the Client API refuses to remove it. Admins can still remove it from the Portal, and the Server API is not affected.
Administrative removal
Admins can remove authenticators for users through the Authsignal Portal:- Navigate to the Users section
- Search for and select the user
- Scroll down to see the enrolled authenticators
- Remove specific methods as needed


