---
title: "Poll and exchange an approved agent login"
method: POST
path: "/v1/auth/device/token"
tags: ["Authentication"]
---

# Poll and exchange an approved agent login

`POST /v1/auth/device/token`

## Request

- Base URL: `https://api.asoskill.com`
- URL: `https://api.asoskill.com/v1/auth/device/token`
- Auth: none required

Returns authorization_pending until the account owner acts. After approval, returns a retry-safe encrypted API-key envelope that only the initiating client can decrypt. This request does not cost a credit.

## Request body

- DeviceTokenRequest
  - `deviceCode` string, required
  - `codeVerifier` string, required

## Response `200`

Encrypted API credential and metadata

- DeviceTokenResponse
  - `tokenType` 'Bearer', required
  - `credential` CredentialEnvelope, required
    - `algorithm` 'A256GCM', required
    - `iv` string, required
    - `ciphertext` string, required
    - `tag` string, required
  - `apiKey` object, required
    - `id` string, uuid, required
    - `name` string, required
    - `scopes` ApiKeyScope[], required
    - `expiresAt` string, date-time, nullable, required

## Other responses

- `400`: The request body or parameters are invalid; no credit is consumed
- `401`: The bearer credential is missing, invalid, expired, or revoked; no credit is consumed
- `403`: The account owner denied the connection request; no credit is consumed
- `429`: Request capacity or a rate allowance was exceeded; no credit is consumed. Respect Retry-After when present, otherwise retry with exponential backoff and jitter.
- `500`: Unexpected processing failure; any reserved credit is restored

---

[API](https://skmtc.dev/asoskill/apis/aso-skill-developer-api.md) · [All operations](https://skmtc.dev/asoskill/apis/aso-skill-developer-api/llms.txt) · [OpenAPI document](https://skmtc.dev/asoskill/apis/aso-skill-developer-api/revisions/c9808e5357cf?raw)