---
title: "Poll for CLI device-authorization approval (RFC 8628)"
method: POST
path: "/auth/cli/poll"
tags: ["CLI Auth"]
---

# Poll for CLI device-authorization approval (RFC 8628)

`POST /auth/cli/poll`

## Request

- Base URL: `https://krova.cloud/api/v1`
- URL: `https://krova.cloud/api/v1/auth/cli/poll`
- Auth: none required

Public, unauthenticated. The CLI submits its deviceCode until the user approves or denies. On approval a real API key is minted ONCE, scoped to the approved Space and the approving user's membership, and returned a single time. Rate-limited per client IP.

## Request body

- object
  - `deviceCode` string, required: The device code from /auth/cli/start.

## Response `200`

Approved — API key minted (returned once)

- object
  - `apiKey` string, required: The full API key. Shown once and never returned again — store it securely.
  - `spaceId` string, required: The Space the key is scoped to.

## Other responses

- `400`: Bad request
- `403`: The user denied the login request
- `410`: The device code expired, was already consumed, or is unknown
- `428`: Authorization still pending — keep polling at the given interval
- `429`: Rate limit exceeded (10 mutations / 60s)

---

[API](https://skmtc.dev/krova/apis/krova-cloud-api.md) · [All operations](https://skmtc.dev/krova/apis/krova-cloud-api/llms.txt) · [OpenAPI document](https://skmtc.dev/krova/apis/krova-cloud-api/revisions/46bb68281ce1?raw)