---
title: "Device Code Approve"
method: POST
path: "/api/oauth2/device/approve"
tags: ["OAuth 2.1"]
---

# Device Code Approve

`POST /api/oauth2/device/approve`

## Request

- Base URL: `https://api.agentstack.tech` (the document declares no server; this is the origin it was published from)
- URL: `https://api.agentstack.tech/api/oauth2/device/approve`
- Auth: one of:
  - API key in header `X-API-Key`
  - HTTP bearer

Approve a pending device_code authorization.

The user must already be authenticated (session cookie / Bearer). Only the
scopes in `scopes_approved` (a subset of the requested ones) are granted; if
omitted, all requested scopes are granted.

## Headers

- `Idempotency-Key` string

## Request body

- BodyDeviceCodeApproveApiOauth2DeviceApprovePost
  - `user_code` string, nullable: User code shown in the device UI
  - `link_id` string, nullable: Bot link ticket id
  - `link_code` string, nullable: Bot link ticket secret
  - `scopes_approved` string[], nullable: Subset of requested scopes to actually grant
  - `project_id` integer, nullable: Project to bind the issued token to

## Response `200`

Successful Response

- unknown

## Other responses

- `400`: Bad Request
- `401`: Unauthorized
- `403`: Forbidden
- `404`: Not Found
- `409`: Conflict
- `422`: Validation Error
- `429`: Too Many Requests
- `500`: Internal Server Error

---

[API](https://skmtc.dev/agentstack/apis/agentstack-core-api.md) · [All operations](https://skmtc.dev/agentstack/apis/agentstack-core-api/llms.txt) · [OpenAPI document](https://skmtc.dev/agentstack/apis/agentstack-core-api/revisions/8ecf3406e74a?raw)