What the approval page shows: the tenant and its host, the upstream origin, the operator who asked, when it expires, exactly what the gateway records (disclosure), and the signed-in user's workspaces with whether each can take the key by the rules the database answers (ADMIN or above, a paid plan, API access); Accounts' entitlement is asked at approval. The owner email is shown in full only to that owner, and workspaces are listed only for them. Never returns the device code.

A POST so the user code is never in a URL (and so never in a request log line), from the page itself: Sec-Fetch-Site: same-origin (or, without it, the web application's own Origin) and a JSON body, as approve requires.

{
  "user_code": "BCDF-GHJK"
}

{
  "disclosure": {
    "evaluated_methods": [
      "POST",
      "PUT",
      "PATCH",
      "DELETE"
    ],
    "header_values_recorded": [
      "Content-Type",
      "Idempotency-Key"
    ],
    "never_recorded": [
      "other request headers",
      "response bodies"
    ]
  }
}