---
title: "Poll for the agent token"
method: POST
path: "/auth/device/token"
tags: ["Device authorization"]
---

# Poll for the agent token

`POST /auth/device/token`

## Request

- Base URL: `https://dungbeetle.dev`
- URL: `https://dungbeetle.dev/auth/device/token`
- Auth: none required

Poll with the `device_code` until the human approves. Non-issued states
are `400` with an RFC 8628 code in `error` (mirrored in `code`):
`authorization_pending`, `access_denied`, `expired_token`,
`invalid_grant` (unknown or already-redeemed code). Polling too fast
yields `429` with `slow_down` and a `Retry-After` header. Each code is
redeemable exactly once.

## Request body

- object
  - `device_code` string, required

## Response `200`

Approved — the agent token, shown exactly once.

- object
  - `token` string, required: Bearer agent token (dbat_ prefix).
  - `token_type` 'bearer', required
  - `label` string, required
  - `scopes` AgentScope[], required
  - `repository` object, required
    - `id` string, required
    - `name` string

## Other responses

- `400`: Not (yet) issued. `error`/`code` is one of `authorization_pending`, `access_denied`, `expired_token`, `invalid_grant`.
- `429`: Polling too fast — `error`/`code` is `slow_down`; honor `Retry-After`.

---

[API](https://skmtc.dev/dungbeetle/apis/dungbeetle-cloud-api.md) · [All operations](https://skmtc.dev/dungbeetle/apis/dungbeetle-cloud-api/llms.txt) · [OpenAPI document](https://skmtc.dev/dungbeetle/apis/dungbeetle-cloud-api/revisions/74778b90420a?raw)