«Confirm the recovery password to remove the last passkey.» (recovery_required)

Symptom

When removing a passkey, «Confirm the recovery password to remove the last passkey.» appears. The API answers 409 recovery_required.

Cause

It is the account's last passkey (or last strong authenticator). So you are not left without a strong way in, removal requires confirming your recovery method: the account password.

Fix

1. In the «Remove device» dialog, fill «Recovery password» with the account password.
2. Confirm.

Better still: first create another passkey (or link a phone) and only then remove the old one.

I am in a recovery session

A recovery session removes an authenticator only while another stays active. Create the replacement passkey, sign in with it and only then remove the old one. See Recovery session.

When to escalate

If you do not remember the password and must remove the passkey (for example from a stolen device), use «I forgot my access details» to set a new one, or ask your administrator for an authenticator reset, which revokes the passkey for you.