---
title: "Manage passkeys and sessions"
description: "Let a signed-in person add and remove passkeys, sign other devices out, and delete their account."
canonical_url: "https://nuxt-backend.dev/docs/auth/accounts/security"
---
# Manage passkeys and sessions

> Let a signed-in person add and remove passkeys, sign other devices out, and delete their account.

The module mounts `/security` (module option `pages.security`) behind the `auth` middleware. It renders `<SecuritySettings>`, built entirely on `useAuth`, `usePasskeys` and `useSessions`, in three sections you can pick with `sections`: `passkeys`, `sessions` and `danger`.

```vue
<template>
  <SecuritySettings :sections="['passkeys', 'sessions']" />
</template>
```

## Passkeys

`usePasskeys()` lists the person's passkeys and adds, renames and removes them:

```ts
const { passkeys, add, rename, remove, isLoading, error } = usePasskeys()
await add()                        // runs the browser's passkey ceremony
await rename(passkeyId, 'Laptop')
await remove(passkeyId)
```

An administrator acting as the account (impersonating it) can see its passkeys but cannot add, rename or remove one: a passkey would let them back in after the visit.

## Signed-in devices

`useSessions()` is a live list of the person's unexpired sessions, every one of them, latest expiry first, with `current` marking this browser. `revoke(id)` signs one out and `revokeOthers()` every other one; each rejects with what the call threw, `isPending` is `true` while one runs, and `error` holds the failure as `{ code, data, message }`. A failed read of the list lands in `error` too, and never throws. `describeUserAgent(userAgent)` turns a session's user agent into a label such as `Chrome · macOS`, or `null` when there is nothing to describe, so your page words an unknown device itself. It reads `listSessions` and calls `revokeSession`, which `backend/auth.ts` re-exports from `setupAuth`, and works for sessions of any age.

## Deletion

Every address is verified by the code that signs the person in, so there is nothing left to verify here. The `danger` section deletes the account: the person confirms by email first, and `setupAuth`'s `onUserDeleted` hook runs once the account is gone. An administrator acting as the account cannot delete it. Destructive actions ask through the `confirm` prop first (`window.confirm` by default).

## Its props, events and slots

`<SecuritySettings>` takes `sections` and `confirm`, emits `passkey-added`, `passkey-removed(id)`, `session-revoked(id)`, `sessions-revoked`, `delete-requested`, `signed-out` and `error(message)`, and has the slots `passkeys`, `passkey`, `sessions`, `session`, `danger` and `footer`. Its copy comes from `appConfig.backend.labels.security`.


## Sitemap

See the full [sitemap](https://nuxt-backend.dev/sitemap.md) for all pages.