Delete or suspend users

If you want to prevent access by a user, you can delete or suspend them.

You need to be a Kinde Owner or Admin to perform these actions. See Team member roles for more information.

Delete a user

Link to this section

Deleting a user is a permanent action and cannot be undone.

1. Sign in to your Kinde dashboard and select Users.

2. Find the user you want to delete.

3. Select the three dots menu in the user’s row, then select Delete user. A confirmation window opens.

   

4. Check the Yes, I definitely want to delete checkbox and select Delete user. The user will be deleted.

When the user tries to sign in, they will be prompted to sign up (if self-sign-up is allowed in your business).

Suspend a user

Link to this section

When you don’t want to permanently delete a user, but restrict their access, you can suspend them:

1. Sign in to your Kinde dashboard and select Users.
2. Find the user you want to suspend.
3. Select the three dots menu, then select Suspend user. 

A Suspended badge appears next to their name on the user list. When the user tries to sign in, they will receive an error and will not be able to sign in.

Restore a suspended user

Link to this section

1. Go to the Users section in Kinde.
2. Find the suspended user you want to restore.
3. Select the three dots menu, then select Restore user.

This reinstates their access. When the user tries to sign in, their access will be restored.

Suspending an organization

Link to this section

The above sections explain how to suspend a user. You can also suspend an organization to prevent all users from signing in to that specific organization. For details on suspending an organization, see Suspend an organization.

What happens to sessions and tokens

Link to this section

When you suspend or delete a user, Kinde immediately ends their authenticated sessions and invalidates their refresh tokens. The user cannot sign in again, and any attempt to refresh their tokens fails with invalid_grant.

Access tokens the user’s app already holds are not affected, and remain valid until they expire. Access tokens are self-contained JWTs that your API validates locally, so there is nothing for Kinde to withdraw once one has been issued.

This matters if you rely on deletion to cut off access instantly. Until the user’s access token expires, your API will still accept it. To narrow that window, shorten your access token lifetime. See What revocation does and doesn’t do.

This applies whether you delete or suspend the user in the Kinde admin area or through the Management API.

Can I block users by email, username, or phone number?

Link to this section

Kinde does not have a built-in blocklist for specific email addresses, usernames, or phone numbers. Suspending or deleting a user removes their existing account, but does not prevent someone from signing up again with the same identifier if self-sign-up is enabled.

To block access for accounts created with a specific identifier (after sign-up), use one of these workarounds:

• Workflows — Use a post-authentication workflow to check the authenticating user’s email, username, or phone number against a blocklist stored in an environment variable or external data source. If matched, the workflow can deny access using the deny action.
• Webhooks — Subscribe to the user.created event via webhooks. When a new user signs up with a blocked identifier, call the Management API to suspend or delete them as soon as the event is processed.
• Management API — React to sign-up events and use the PATCH /api/v1/user endpoint to suspend users whose identifiers match your blocklist.

The same expiry window applies to these workarounds. Suspending or deleting a user in response to a webhook stops them getting new tokens, but an access token already issued during sign-up stays valid until it expires — see What happens to sessions and tokens above. Deleting an account does not prevent the same identifier from signing up again if self-sign-up is enabled. If you need to block future sign-ups, keep a persistent identifier check (for example in a post-authentication workflow) or suspend the user instead of deleting them.

None of these workarounds prevent the initial sign-up event from completing — they block access after the fact. If preventing sign-up at the point of registration is a hard requirement, contact Kinde support to discuss options.