How to mass delete devices in Alexa

jimtng · April 11, 2026, 7:45am

This has been a multi year pain for me ever since they removed alexa.amazon.com web interface.

Now there’s a way to mass delete devices on alexa to start over again… such a huge relief for me!

github.com/Shereef/Python-Delete-Alexa-Devices

Found much simpler solution with javascript

opened 11:00AM - 19 Jan 26 UTC

closed 01:51PM - 20 Jan 26 UTC

rPraml

Hello. Thank you @Shereef for this script, and @Apollon77 for https://github.co…m/Apollon77/alexa-remote I spent a whole day to get the HTTP sniffer working (but without succeess) I tried on my non rooted phone and on android emulators on WSL. During this research, I've found a much simpler solution, that only requires some javascript entered in the browser console. I noticed, that you will get/have a valid cookie, if you are logged in in your amazon account. So the whole HTTP sniffing is not needed. (It is/was only needed for reverse enginerring, so thanks for that work) We can call the APIs directly from the browser (until amazon will change something, e.g. check for user agent..., csrf) We can also delete `ghost` devices, that cannot be deleted in the app ## Delete all Smarthome devices in ~ 1 minute (Improved solution - one-liner) I tried this multiple times. It seems, that no CSRF value is needed (see comments below 1. Ensure, that you are logged in in your amazon (.de/.com) account 2. Check under which of the following URLs you'll get a list of your devices: - https://alexa.amazon.de/api/behaviors/entities?skillId=amzn1.ask.1p.smarthome - https://alexa.amazon.com/api/behaviors/entities?skillId=amzn1.ask.1p.smarthome - https://layla.amazon.com/api/behaviors/entities?skillId=amzn1.ask.1p.smarthome - https://pitangui.amazon.com/api/behaviors/entities?skillId=amzn1.ask.1p.smarthome - https://alexa.amazon.co.jp/api/behaviors/entities?skillId=amzn1.ask.1p.smarthome 3. If you have found the URL, that returns a json with your devices, paste this script in the developer-console (use at own risk!): ```javascript devices = await (await fetch('/nexus/v1/graphql', { method: 'POST', headers: {"Content-Type": "application/json","Accept": "application/json"}, body: JSON.stringify({query: `query { endpoints { items { friendlyName legacyAppliance { applianceId }}} } `})})).json();for (const device of devices.data.endpoints.items) console.log(await fetch(`/api/phoenix/appliance/${encodeURIComponent(device.legacyAppliance.applianceId)}`, { method: "DELETE", headers: { "Accept": "application/json", "Content-Type": "application/json"}})) ``` 4. Refresh the page. (should be empty - if not you may have a CSRF problem) 5. Say `Alexa discover devices` 6. Refresh page again (should show devices only provided by active skills) ### Delete all Smarthome devices with CSRF value Try this, if the above will not work: 1. Ensure, that you are logged in in your amazon (.de/.com) account 2. Check under which of the following URLs you'll get a list of your devices: - https://alexa.amazon.de/api/behaviors/entities?skillId=amzn1.ask.1p.smarthome - https://alexa.amazon.com/api/behaviors/entities?skillId=amzn1.ask.1p.smarthome - https://layla.amazon.com/api/behaviors/entities?skillId=amzn1.ask.1p.smarthome - https://pitangui.amazon.com/api/behaviors/entities?skillId=amzn1.ask.1p.smarthome - https://alexa.amazon.co.jp/api/behaviors/entities?skillId=amzn1.ask.1p.smarthome If you've found the correct URL (some JSON retured) keep that page open 3. Get the csrf number: - open www.amazon.com / www.amazon.de in a new browser tab and put any article in your basket - open your basket - open dev-tools (F12) wait a while until the network calms down and clear network tab - increase the quantity of the article - you should see a `ref=ox_sc_update_quantity` request. Inspect that request for a `csrf` header or a `csrf=` value in the cookie header. **Copy that number** - if you only find a `anti-csrftoken-a2z` - you may try that string, too 4. Switch back to the tab with the JSON 5. Enter the following in the dev-tools (browser console) - copy line by line ```javascript csrf='<insert-csrf-value-here>' devices = await (await fetch('/nexus/v1/graphql', { method: 'POST', headers: {"Content-Type": "application/json","Accept": "application/json"}, body: JSON.stringify({query: `query { endpoints { items { friendlyName legacyAppliance { applianceId }}} } `})})).json() for (const device of devices.data.endpoints.items) console.log(await fetch(`/api/phoenix/appliance/${encodeURIComponent(device.legacyAppliance.applianceId)}`, { method: "DELETE", headers: { "Accept": "application/json", "Content-Type": "application/json", "csrf" : csrf }})) ``` ### What the javascript does The first line sets the CSRF value. (which is used by the third line) The second line fetches all appliance-IDs from the graphql endpoint (you may inspect the `devices.data.endpoints.items` value before continuing with line 3) The third line iterates over all devices and deletes them. The script itself must run, while a page is open, you may notice, it uses `fetch('/nexus/v1/graphql')` without hostname. So if you execute it, it will use the same host (with all cookies) from the current page. So it is important, that you execute it in the tab, where the JSON is returend **Note:** If the browser (I use firefox) renders the JSON as JSON, it will not work. Luckily https://alexa.amazon.de/api/behaviors/entities?skillId=amzn1.ask.1p.smarthome returns `text/html` - although it is JSON. You may also just open https://alexa.amazon.de/ if this is a problem. The most difficult part for me, was to get the correct applianceIds and pass them correctly encoded to the `/api/phoenix/appliance/` endpoint. Note: This endpoint always returns with 200, nevertheless, the device could be deleted or not You *may* have to run the script twice. ### CSRF Token To perform a successful delete, you *may* need a valid `csrf` value which is either a number (`csrf=`) or a string with about 60 chars. This string is normally set in the `anti-csrftoken-a2z` header. The numeric value is set either in the `csrf` header or on the cookie. You may find a valid csrf tokem in the page source of https://www.amazon.de/alexa-privacy/apd/myad?disableGlobalNav=true&ref=activityHistory While I've got a numeric value on firefox, I got the `anti-csrftoken-a2z` in edge. In edge I had the `https://alexa.amazon.de/` page open, so it might be sufficient, if a correct referrer is set. In this case, set anything to csrf value

Hope this helps someone out there.