diff --git a/app/main/views/user_profile.py b/app/main/views/user_profile.py
index a53d0f76f..e994983f7 100644
--- a/app/main/views/user_profile.py
+++ b/app/main/views/user_profile.py
@@ -11,6 +11,7 @@ from flask import (
     url_for,
 )
 from flask_login import current_user
+from notifications_python_client.errors import HTTPError
 from notifications_utils.url_safe_token import check_token
 
 from app import user_api_client
@@ -283,8 +284,18 @@ def user_profile_manage_security_key(key_id):
 @main.route("/user-profile/security-keys/<uuid:key_id>/delete", methods=['POST'])
 @user_is_platform_admin
 def user_profile_delete_security_key(key_id):
-    user_api_client.delete_webauthn_credential_for_user(
-        user_id=current_user.id,
-        credential_id=key_id
-    )
+
+    try:
+        user_api_client.delete_webauthn_credential_for_user(
+            user_id=current_user.id,
+            credential_id=key_id
+        )
+    except HTTPError as e:
+        message = "Cannot delete last remaining webauthn credential for user"
+        if e.message == message:
+            flash("You cannot delete your last security key.")
+            return redirect(url_for('.user_profile_manage_security_key', key_id=key_id))
+        else:
+            raise e
+
     return redirect(url_for('.user_profile_security_keys'))
diff --git a/tests/app/main/views/test_user_profile.py b/tests/app/main/views/test_user_profile.py
index 97300d072..c03efa40d 100644
--- a/tests/app/main/views/test_user_profile.py
+++ b/tests/app/main/views/test_user_profile.py
@@ -3,6 +3,7 @@ import uuid
 
 import pytest
 from flask import url_for
+from notifications_python_client.errors import HTTPError
 from notifications_utils.url_safe_token import generate_token
 
 from tests.conftest import (
@@ -539,3 +540,33 @@ def test_delete_security_key(
         credential_id=webauthn_credential['id'],
         user_id=platform_admin_user["id"]
     )
+
+
+def test_delete_security_key_handles_last_credential_error(
+    client_request,
+    platform_admin_user,
+    webauthn_credential,
+    mocker,
+):
+    client_request.login(platform_admin_user)
+    mocker.patch(
+        'app.user_api_client.get_webauthn_credentials_for_user',
+        return_value=[webauthn_credential],
+    )
+
+    mocker.patch(
+        'app.user_api_client.delete_webauthn_credential_for_user',
+        side_effect=HTTPError(
+            response={},
+            message='Cannot delete last remaining webauthn credential for user'
+        )
+    )
+
+    page = client_request.post(
+        '.user_profile_delete_security_key',
+        key_id=webauthn_credential['id'],
+        _follow_redirects=True
+    )
+    assert 'Manage ‘Test credential’' in page.find('h1').text
+    expected_message = "You cannot delete your last security key."
+    assert expected_message in page.find('div', class_="banner-dangerous").text