tokens

Exchange the official CLI OAuth access token from `kody login` for a user-owned `kody_at_` device token.

Exchange the official CLI OAuth access token from kody login for a user-owned kody_at_ device token. The OAuth bearer is accepted only on this route (and on local-execute HTTP for older CLIs). The token value is returned once. Scopes are the org-permission vocabulary; the caller role still applies. Requires lifetime (short or long) or both idle and max seconds.

Org permission: none (touches no org data).

post/v1/tokens/device

Request

  • Base URL: https://api.kody.codes
  • URL: https://api.kody.codes/v1/tokens/device
  • Auth: HTTP bearer

Request body

lifetime'short' | 'long'

Required unless idle_ttl_seconds and max_lifetime_seconds are both set. short = 1h idle / 24h max. long = 14d idle / 3mo max. Single-task agents should use short.

idle_ttl_secondsinteger

Seconds without use before the token expires. Required with max_lifetime_seconds when lifetime is omitted.

max_lifetime_secondsinteger

Absolute lifetime cap in seconds. Required with idle_ttl_seconds when lifetime is omitted.

namestring required

Label shown in token lists, e.g. kody-cli on laptop.

Response

Success.

idstring required
namestring required
org_idstring required

For org-bound tokens: the fixed org id. For user-owned tokens: the personal org id (placeholder; each request picks an org via ?org=).

org_binding'org' | 'user' required

org: fixed to org_id. user: person-owned; pass ?org=<slug> on each request (default personal org). Membership/grants are checked live.

scopesstring[] required
status'active' | 'expired' | 'revoked' required
idle_ttl_secondsinteger required
expires_atstring required

Sliding expiry. Each successful request pushes it forward.

max_expires_atstring required

Absolute expiry. The token never outlives it.

created_viastring required
created_atstring required
last_used_atstring nullable required
rotated_atstring nullable required
revoked_atstring nullable required
profile_namestring nullable required

Named connection profile this token is bound to, or null for unlimited.

tokenstring required

The bearer token. Shown once; Kody stores only a hash. Send it as Authorization: Bearer <token>.

token_type'Bearer' required

Changes

No recorded changes to this operation across all 1 revision of this API.