---
title: "POST /auth/device/token"
method: POST
path: "/auth/device/token"
---

# POST /auth/device/token

`POST /auth/device/token`

## Request

- Base URL: `https://api.caveman.so/api/v1`
- URL: `https://api.caveman.so/api/v1/auth/device/token`
- Auth: none required

POST /api/v1/auth/device/token on the Caveman Cloud control plane. Unauthenticated but rate-limited; it establishes or ends a session rather than reading tenant data. Not exposed to autonomous agents: Not RBAC-guarded — part of the authentication or webhook plane. Agents authenticate through a scoped control-plane session and never touch these directly.

## Response `2XX`

Successful response. Exact status depends on synchronous or durable delivery outcome.

## Other responses

- `4XX`: Structured failure. `error.code` is stable; `error.request_id` is echoed in the x-cave-request-id header.
- `5XX`: Structured failure. `error.code` is stable; `error.request_id` is echoed in the x-cave-request-id header.

---

[API](https://skmtc.dev/caveman/apis/caveman-cloud-api.md) - [All operations](https://skmtc.dev/caveman/apis/caveman-cloud-api/llms.txt) - [OpenAPI document](https://skmtc.dev/caveman/apis/caveman-cloud-api/revisions/508312d01cfc?raw)