Delete users

Two ways, because they are two different actions.

The person deletes their own account. Signed in, with their password. Publishable key.

1curl -X POST "$BASE/v1/auth/delete-user" \2  -H "authorization: Bearer $PK" \3  -H "content-type: application/json" \4  -b "session cookie" \5  -d '{"password":"their-password"}'

A password or a session less than a day old is required. This is irreversible, and a stale cookie on a shared laptop should not be enough.

Users who signed in with a social provider have no password. Calling this without one sends a confirmation mail instead, so they can still leave:

That is worth knowing if you offer social login — otherwise the people who cannot supply a password are exactly the ones who cannot get out.

You delete somebody's account. From your server, with a secret key — for a support request, an erasure mail, or clearing out a migration.

1curl -X DELETE "$BASE/v1/auth/users/zafSejoiTBShUIhggLMox0Tyz4qKrSrV" \2  -H "authorization: Bearer $SK"

1{ "id": "zafSejoiTBShUIhggLMox0Tyz4qKrSrV", "email": "alan@example.com", "deleted": true }

Like listing, this answers no CORS and takes a secret key only.

Both are hard deletes

The account goes, and its sessions and linked providers go with it. There is no undo and no recycle bin — if you need one, keep your own record before calling.

An account you delete stops costing you at the next nightly count.

Errors