<!-- section: Auth API · status: building · source: docs/auth-api/13-delete-users.md -->

> Two ways, because they are two different actions — the person leaving, and you removing them.


# Delete users

Two ways, because they are two different actions.

## POST /v1/auth/delete-user

**The person deletes their own account.** Signed in, with their password.
**Publishable** key.

```bash Request
curl -X POST "$BASE/v1/auth/delete-user" \
  -H "authorization: Bearer $PK" \
  -H "content-type: application/json" \
  -b "session cookie" \
  -d '{"password":"their-password"}'
```

A password **or** a session less than a day old is required. This is
irreversible, and a stale cookie on a shared laptop should not be enough.

**Users who signed in with a social provider have no password.** Calling this
without one sends a confirmation mail instead, so they can still leave:

| Flow | What the person gets |
|---|---|
| Confirm account deletion | A link that deletes the account when followed |

That is worth knowing if you offer social login — otherwise the people who
cannot supply a password are exactly the ones who cannot get out.

## DELETE /v1/auth/users/:id

**You delete somebody's account.** From your server, with a **secret key** — for
a support request, an erasure mail, or clearing out a migration.

```bash Request
curl -X DELETE "$BASE/v1/auth/users/zafSejoiTBShUIhggLMox0Tyz4qKrSrV" \
  -H "authorization: Bearer $SK"
```

```json Response
{ "id": "zafSejoiTBShUIhggLMox0Tyz4qKrSrV", "email": "alan@example.com", "deleted": true }
```

Like [listing](/docs/auth-api/get-users), this answers no CORS and takes a secret
key only.

## Both are hard deletes

The account goes, and its sessions and linked providers go with it. **There is no
undo and no recycle bin** — if you need one, keep your own record before calling.

An account you delete stops costing you at the next nightly count.

## Errors

| Status | Code | Means |
|---|---|---|
| `401` | `INVALID_PASSWORD` | Wrong password on the self-service call |
| `403` | `SESSION_NOT_FRESH` | No password given and the session is over a day old |
| `404` | — | No user with that id in this project |
| `401` | — | Publishable key on the `DELETE /users/:id` form |