---
title: "Poll for the outcome of a device authorization (T453)"
method: POST
path: "/auth/device/token"
tags: ["Auth"]
---

# Poll for the outcome of a device authorization (T453)

`POST /auth/device/token`

## Request

- Base URL: `http://localhost:38200`
- URL: `http://localhost:38200/auth/device/token`
- Auth: none required

Public. The headless client polls this with the `device_code` from POST /auth/device/start, no more often than every `interval` seconds (RFC 8628-style slow_down backoff), until it receives `api_key` exactly once -- the key can never be redeemed a second time through this flow. Rate limited to 30 requests / minute per IP.

## Request body

- object
  - `device_code` string, required

## Response `200`

Approved -- the minted API key, returned exactly once.

- object
  - `api_key` string

## Other responses

- `400`: Malformed request body (`{ error: "invalid_request" }`), or a terminal grant state the client cannot recover from without starting a new flow: the grant expired (`expired_token`), the user declined it (`access_denied`), or `device_code` is unrecognized (`invalid_grant`).
- `428`: Not yet approved -- retryable. `authorization_pending` means keep polling at the current interval; `slow_down` means the client polled faster than `interval` and must back off (the interval itself is unchanged).
- `429`: Rate limit exceeded for this endpoint.

---

[API](https://skmtc.dev/contextq/apis/contextq-api.md) · [All operations](https://skmtc.dev/contextq/apis/contextq-api/llms.txt) · [OpenAPI document](https://skmtc.dev/contextq/apis/contextq-api/revisions/7afc44056a22?raw)