Skip to main content
POST
Begin the RFC 8628 device-code token mint

Body

application/json
scopes
string[]
required

Requested capability scopes (validated against the user's tier at approval).

Required array length: 1 - 64 elements
client_name
string

Free-text agent identifier shown to the approving human.

Maximum string length: 80
sandbox
boolean

Mint a sandbox/test-mode token: WRITE verbs return a simulated receipt instead of mutating; reads serve real data. Still a real token with real scopes — this does NOT widen access. Immutable after mint. See the root x-sandbox extension.

Response

Device-code grant started.

device_code
string
required

Long secret — the agent keeps it, never displays it.

user_code
string
required

Short human-readable code.

verify_url
string
required
expires_in
integer
required

Seconds (900).

interval
integer
required

Recommended poll interval in seconds (5).

verify_url_complete
string

verify_url + ?code= prefilled.