Auth

Start an OAuth 2.0 Device Authorization Grant (RFC 8628-shaped) flow (T453)

Public, no request body. Lets a headless/CLI environment that cannot open a browser (an SSH box, a headless Claude Code session) begin obtaining a ContextQ API key: mints a device_code (an opaque polling secret used by POST /auth/device/token) and a short human-typable user_code, both returned to the caller exactly once. The human opens verification_uri (or verification_uri_complete, which pre-fills the user_code), signs in, and approves the device via the dashboard against a chosen workspace; the caller meanwhile polls /auth/device/token with device_code until it receives the minted key. Rate limited to 10 requests / 5 minutes per IP. See src/services/device-authorization.service.ts for the full flow.

post/auth/device/start

Request

  • Base URL: http://localhost:38200
  • URL: http://localhost:38200/auth/device/start
  • Auth: none required

Response

Device authorization started.

device_codestring

Opaque polling secret for POST /auth/device/token. Shown once.

user_codestring

Human-typable code the user enters at verification_uri, formatted XXXX-XXXX.

verification_uristring uri
verification_uri_completestring uri

verification_uri with user_code pre-filled as a query param.

expires_ininteger

Seconds until device_code/user_code expire (10 minutes).

intervalinteger

Minimum seconds between polls before the client must slow_down.

Changes

No recorded changes to this operation across all 1 revision of this API.