---
title: "Device Authorize"
method: POST
path: "/api/v1/oauth/device/authorize"
tags: ["oauth2-server"]
---

# Device Authorize

`POST /api/v1/oauth/device/authorize`

## Request

- Base URL: `https://memory.kagura-ai.com` (the document declares no server; this is the origin it was published from)
- URL: `https://memory.kagura-ai.com/api/v1/oauth/device/authorize`
- Auth: none declared

Device Authorization endpoint (RFC 8628 Section 3.1).

Called by CLI clients to obtain a device_code + user_code pair.
No authentication required — this is a public endpoint.

Limited per client address to ``oauth_device_authorize_rate_limit_per_minute``
requests per minute (#1656). Over the limit it returns 429 in the RFC 6749
§5.2 error shape (RFC 8628 §3.2) with ``Retry-After``, before any row is
written.

The body is ``application/x-www-form-urlencoded`` (RFC 8628 §3.1) or
``application/json`` (#1671). It is read after the limit is counted, so a
refused body still counts. A missing or unsupported Content-Type, a
malformed body or a missing ``client_id`` returns 400 ``invalid_request``,
an oversized body returns 413 ``invalid_request``, an unknown ``client_id``
returns 400 ``invalid_client``, an admin-managed client registered without a
memory scope returns 400 ``invalid_scope`` and a failure to store the grant
returns 500 ``server_error``, all in the RFC 6749 §5.2 error shape.

The granted scope follows ``granted_scope`` (#1686), as at ``/authorize``.

## Request body

- object: Device Authorization Request (RFC 8628 Section 3.1). Sent as application/x-www-form-urlencoded (RFC 8628 §3.1) or application/json.
  - `client_id` string, required: OAuth2 client identifier
  - `scope` string, nullable: Requested scope (space-separated)

## Response `200`

Successful Response

- DeviceAuthorizationResponse: Device Authorization Response (RFC 8628 Section 3.2).
  - `device_code` unknown, required
  - `user_code` unknown, required
  - `verification_uri` unknown, required
  - `verification_uri_complete` unknown, required
  - `expires_in` unknown, required
  - `interval` unknown, required

## Other responses

- `400`: RFC 6749 §5.2 error: `invalid_request` for a missing or unsupported Content-Type, a malformed body or a missing `client_id`; `invalid_client` for an unknown `client_id`; `invalid_scope` for an admin-managed client registered without a memory scope
- `413`: Request body larger than 4096 bytes (`invalid_request`)
- `429`: Too many device authorization requests from this address
- `500`: The device authorization could not be stored (`server_error`)

---

[API](https://skmtc.dev/kagura-ai/apis/kagura-memory-cloud.md) · [All operations](https://skmtc.dev/kagura-ai/apis/kagura-memory-cloud/llms.txt) · [OpenAPI document](https://skmtc.dev/kagura-ai/apis/kagura-memory-cloud/revisions/09f17f5ada29?raw)