oauth2-server

Device Confirm

User consent endpoint for device authorization.

Requires session authentication. Sets authorized_at or denied_at on the device code record so the polling CLI receives the decision. Every approval emails the user a security notice after the commit (Issue #1752): a device code can be phished (the attacker starts the flow and gets the victim to approve the code), so unlike authorization-code consent this is not limited to the first grant; coalescing bounds the volume. Scheduling the notice touches no DB, so nothing here runs sync DB work for it.

The database work runs in a worker thread (#1770): the approval share-locks the owner's users row and may wait on a reset holding it.

post/api/v1/oauth/device/confirm

Request

  • Base URL: https://memory.kagura-ai.com (the document declares no server; this is the origin it was published from)
  • URL: https://memory.kagura-ai.com/api/v1/oauth/device/confirm
  • Auth: none declared

Request body

user_codestring required
approveboolean

Response

Successful Response

statusunknown required
user_codeunknown required

Changes

No recorded changes to this operation across all 2 revisions of this API.