Account deletion

DELETE /api/auth/account deletes a user account. It clears the user’s auth state in every system Pylon owns: sessions, API keys, linked OAuth accounts, trusted-device records, and the User row. Pylon does this in one transaction. App-owned tables that reference the user are not deleted (see below). The host schema decides what gets purged.

Endpoint

Endpoint	Method	Auth	Purpose
`/api/auth/account`	DELETE	session	Hard-delete the caller’s account

What gets wiped

Pylon performs the following in order:

Revoke all sessions for the user. Pylon revokes the caller’s current session first, so a slow user-row delete cannot leave a usable session.
Revoke all API keys owned by the user (pk.* bearer tokens).
Unlink all OAuth accounts — Google, GitHub, Apple, etc. credentials that were linked to this user.
Revoke all trusted devices — the pylon_trusted_device records for this user.
Delete the User row itself from the entity backing the auth user.
Clear the session cookie on the response so the browser drops it.
Audit log an AccountDelete event with counts of each category.

curl -X DELETE https://your-app/api/auth/account \
  -H 'Authorization: Bearer pylon_token'

Response:

{
  "deleted": true,
  "revoked_sessions": 3,
  "revoked_api_keys": 2,
  "unlinked_accounts": 1
}

Errors:

Status	Code	Reason
401	`AUTH_REQUIRED`	No session
403	`API_KEY_AUTH_FORBIDDEN`	API-key auth can’t delete the account — real session required
400	(storage error code)	The User row delete failed (storage layer rejection)

App-owned tables don’t cascade

Pylon does not delete your app’s tables. If the user has 47 Project rows that point at their user_id, those rows survive the delete. Your app declares its own deletion rules. The canonical pattern is a plugin hook that fires before the user row is wiped:

// crates/plugin/src/builtin/before_delete_user.ts (sketch)
import { plugin } from "@pylonsync/sdk";

export default plugin({
  name: "delete-user-data",
  on: { delete: { entity: "User" } },
  async beforeDelete(ctx, { id: userId }) {
    // Purge app tables that point at this user.
    const projects = await ctx.db.query("Project", { ownerId: userId });
    for (const p of projects) await ctx.db.delete("Project", p.id);
    // ...etc
  },
});

You can also purge inside a mutation wrapper, or with a scheduled cleanup job after the delete. The framework leaves the deletion rule to your app. Some apps tombstone the row, some hard-delete it, and some anonymize the user_id and keep the history.

Confirming first

Do not expose this endpoint without a confirmation step in your UI. The API does not require a password or TOTP re-prompt. Design the frontend flow to confirm the action:

// Dashboard flow:
// 1. User clicks "Delete account"
// 2. Modal asks them to type their email to confirm
// 3. Frontend calls /password/login to verify the password (or /totp/verify for 2FA)
// 4. Only then calls /api/auth/account DELETE

For sensitive apps, gate the call on a fresh TOTP code or a session re-issued within the last 5 minutes.

Audit trail

Pylon writes the AccountDelete audit event before it deletes the user row, so the event row survives. Read it via /api/auth/audit. Operators get a record of which users deleted their account and when, with counts of what was cleared.

Where to go next

Sessions — revoke a single session without deleting the account
API keys — revoke a single key without deleting the account
GDPR export — /api/admin/users/:id/export companion endpoint for data portability

Get started

Core concepts

SSR

Auth

Plugins

Clients

Operations

Compare

Migrate

Account deletion

Endpoint

What gets wiped

App-owned tables don’t cascade

Confirming first

Audit trail

Where to go next

​Endpoint

​What gets wiped

​App-owned tables don’t cascade

​Confirming first

​Audit trail

​Where to go next

Endpoint

What gets wiped

App-owned tables don’t cascade

Confirming first

Audit trail

Where to go next