jimtng
April 11, 2026, 7:45am
1
This has been a multi year pain for me ever since they removed alexa.amazon.com web interface.
Now there’s a way to mass delete devices on alexa to start over again… such a huge relief for me!
opened 11:00AM - 19 Jan 26 UTC
closed 01:51PM - 20 Jan 26 UTC
Hello. Thank you @Shereef for this script,
and @Apollon77 for https://github.co… m/Apollon77/alexa-remote
I spent a whole day to get the HTTP sniffer working (but without succeess)
I tried on my non rooted phone and on android emulators on WSL. During this research, I've found a much simpler solution, that only requires some javascript entered in the browser console.
I noticed, that you will get/have a valid cookie, if you are logged in in your amazon account. So the whole HTTP sniffing is not needed. (It is/was only needed for reverse enginerring, so thanks for that work)
We can call the APIs directly from the browser (until amazon will change something, e.g. check for user agent..., csrf)
We can also delete `ghost` devices, that cannot be deleted in the app
## Delete all Smarthome devices in ~ 1 minute
(Improved solution - one-liner)
I tried this multiple times. It seems, that no CSRF value is needed (see comments below
1. Ensure, that you are logged in in your amazon (.de/.com) account
2. Check under which of the following URLs you'll get a list of your devices:
- https://alexa.amazon.de/api/behaviors/entities?skillId=amzn1.ask.1p.smarthome
- https://alexa.amazon.com/api/behaviors/entities?skillId=amzn1.ask.1p.smarthome
- https://layla.amazon.com/api/behaviors/entities?skillId=amzn1.ask.1p.smarthome
- https://pitangui.amazon.com/api/behaviors/entities?skillId=amzn1.ask.1p.smarthome
- https://alexa.amazon.co.jp/api/behaviors/entities?skillId=amzn1.ask.1p.smarthome
3. If you have found the URL, that returns a json with your devices, paste this script in the developer-console (use at own risk!):
```javascript
devices = await (await fetch('/nexus/v1/graphql', { method: 'POST', headers: {"Content-Type": "application/json","Accept": "application/json"}, body: JSON.stringify({query: `query { endpoints { items { friendlyName legacyAppliance { applianceId }}} } `})})).json();for (const device of devices.data.endpoints.items) console.log(await fetch(`/api/phoenix/appliance/${encodeURIComponent(device.legacyAppliance.applianceId)}`, { method: "DELETE", headers: { "Accept": "application/json", "Content-Type": "application/json"}}))
```
4. Refresh the page. (should be empty - if not you may have a CSRF problem)
5. Say `Alexa discover devices`
6. Refresh page again (should show devices only provided by active skills)
### Delete all Smarthome devices with CSRF value
Try this, if the above will not work:
1. Ensure, that you are logged in in your amazon (.de/.com) account
2. Check under which of the following URLs you'll get a list of your devices:
- https://alexa.amazon.de/api/behaviors/entities?skillId=amzn1.ask.1p.smarthome
- https://alexa.amazon.com/api/behaviors/entities?skillId=amzn1.ask.1p.smarthome
- https://layla.amazon.com/api/behaviors/entities?skillId=amzn1.ask.1p.smarthome
- https://pitangui.amazon.com/api/behaviors/entities?skillId=amzn1.ask.1p.smarthome
- https://alexa.amazon.co.jp/api/behaviors/entities?skillId=amzn1.ask.1p.smarthome
If you've found the correct URL (some JSON retured) keep that page open
3. Get the csrf number:
- open www.amazon.com / www.amazon.de in a new browser tab and put any article in your basket
- open your basket
- open dev-tools (F12) wait a while until the network calms down and clear network tab
- increase the quantity of the article
- you should see a `ref=ox_sc_update_quantity` request. Inspect that request for a `csrf` header or a `csrf=` value in the cookie header. **Copy that number**
- if you only find a `anti-csrftoken-a2z` - you may try that string, too
4. Switch back to the tab with the JSON
5. Enter the following in the dev-tools (browser console) - copy line by line
```javascript
csrf='<insert-csrf-value-here>'
devices = await (await fetch('/nexus/v1/graphql', { method: 'POST', headers: {"Content-Type": "application/json","Accept": "application/json"}, body: JSON.stringify({query: `query { endpoints { items { friendlyName legacyAppliance { applianceId }}} } `})})).json()
for (const device of devices.data.endpoints.items) console.log(await fetch(`/api/phoenix/appliance/${encodeURIComponent(device.legacyAppliance.applianceId)}`, { method: "DELETE", headers: { "Accept": "application/json", "Content-Type": "application/json", "csrf" : csrf }}))
```
### What the javascript does
The first line sets the CSRF value. (which is used by the third line)
The second line fetches all appliance-IDs from the graphql endpoint (you may inspect the `devices.data.endpoints.items` value before continuing with line 3)
The third line iterates over all devices and deletes them.
The script itself must run, while a page is open, you may notice, it uses `fetch('/nexus/v1/graphql')` without hostname. So if you execute it, it will use the same host (with all cookies) from the current page. So it is important, that you execute it in the tab, where the JSON is returend
**Note:** If the browser (I use firefox) renders the JSON as JSON, it will not work. Luckily https://alexa.amazon.de/api/behaviors/entities?skillId=amzn1.ask.1p.smarthome returns `text/html` - although it is JSON. You may also just open https://alexa.amazon.de/ if this is a problem.
The most difficult part for me, was to get the correct applianceIds and pass them correctly encoded to the `/api/phoenix/appliance/` endpoint. Note: This endpoint always returns with 200, nevertheless, the device could be deleted or not
You *may* have to run the script twice.
### CSRF Token
To perform a successful delete, you *may* need a valid `csrf` value which is either a number (`csrf=`) or a string with about 60 chars.
This string is normally set in the `anti-csrftoken-a2z` header. The numeric value is set either in the `csrf` header or on the cookie.
You may find a valid csrf tokem in the page source of https://www.amazon.de/alexa-privacy/apd/myad?disableGlobalNav=true&ref=activityHistory
While I've got a numeric value on firefox, I got the `anti-csrftoken-a2z` in edge. In edge I had the `https://alexa.amazon.de/` page open, so it might be sufficient, if a correct referrer is set. In this case, set anything to csrf value
Hope this helps someone out there.
Gijan
August 19, 2026, 11:12am
2
Continuing the discussion from How to mass delete devices in Alexa :
If anyone prefers a proper graphical interface instead of running Python or raw Javascript code, there is also a Chrome extension for this now.
It’s called Alexa Device Manager . It runs locally in your browser, gives you a clean table UI directly on the Alexa website, and lets you filter or bulk-delete devices with a few clicks.
You can grab it here: https://github.com/stereodruid/Alexa-Device-Manager
demichve
August 22, 2026, 3:52pm
3
These solutions work for nearly all entries.
But I still have some temperature sensors provided by OpenHAB which do not show up in the json data. No chance to delete them.
Anyone with an idea?
Gijan
August 25, 2026, 7:03am
4
You’ve probably already tried, but have you deactivated or deleted the sensors in OpenHab, or tried a skill reconnect?
Gijan
August 25, 2026, 7:05am
5
And it would be great if you opened an issue on GitHub so the devs can analyze and add support for cases like yours.
demichve
August 25, 2026, 8:02am
6
I made some tests with activated OpenHAB skill and can confirm, that all temperature sensors created by OpenHAB will be not part of the json structure and cannot be deleted by these tools.
Nevertheless, I created an issue in the Github to see it there is anyone else with the same issue.
EDIT:
There is now an update 0.5.0 which also deletes this type of devices.
