---
title: "Mint a device_code for an unauthenticated agent (RFC 8628-shaped)"
method: POST
path: "/api/pair/start"
---

# Mint a device_code for an unauthenticated agent (RFC 8628-shaped)

`POST /api/pair/start`

## Request

- Base URL: `https://charm.ing`
- URL: `https://charm.ing/api/pair/start`
- Auth: none declared

Returns a `device_code` (agent-private) and a `user_code` (`CHRM-XXXXXX`, displayed to the user). Codes expire after 10 minutes. Agent then polls `POST /api/pair/poll` until status flips to `approved`. The legacy `/pair/start` path 308s here.

## Request body

- object
  - `label` string: Optional human-readable label. Surfaced to the user on the approval page so they know which agent they’re connecting.

## Response `200`

Codes minted

- PairStartResponse: RFC 8628-shaped device-code response. Poll `POST /api/pair/poll` until the user approves.
  - `device_code` string, required: Agent-private — store securely, never display or log. Anyone with the device_code can poll for the token.
  - `user_code` string, required
  - `verification_url` string, uri, required
  - `verification_url_complete` string, uri
  - `polling_interval` integer, required
  - `expires_in` integer, required

## Other responses

- `429`: Rate limited (per-IP).

---

[API](https://skmtc.dev/charm/apis/charming-api.md) · [All operations](https://skmtc.dev/charm/apis/charming-api/llms.txt) · [OpenAPI document](https://skmtc.dev/charm/apis/charming-api/revisions/a9d06c419b3a?raw)