---
title: "Begin a CLI device-authorization login (RFC 8628)"
method: POST
path: "/auth/cli/start"
tags: ["CLI Auth"]
---

# Begin a CLI device-authorization login (RFC 8628)

`POST /auth/cli/start`

## Request

- Base URL: `https://krova.cloud/api/v1`
- URL: `https://krova.cloud/api/v1/auth/cli/start`
- Auth: none required

Public, unauthenticated. Mints a device code (returned once) and a short human user code, and returns the verification URIs the user opens in a browser to approve. The CLI then polls /auth/cli/poll. Rate-limited per client IP.

## Response `200`

Device-authorization request created

- object
  - `deviceCode` string, required: High-entropy code the CLI keeps secret and presents on each poll. Only its hash is stored server-side.
  - `userCode` string, required: Short human-readable code (KROVA-XXXX-XXXX) the user confirms in the browser.
  - `verificationUri` string, uri, required: Browser URL where the user approves.
  - `verificationUriComplete` string, uri, required: verificationUri with the user code pre-filled.
  - `interval` integer, required: Seconds to wait between polls.
  - `expiresIn` integer, required: Seconds until the device code expires (~600).

## Other responses

- `429`: Rate limit exceeded (10 mutations / 60s)
- `503`: Could not allocate a login code; retry

---

[API](https://skmtc.dev/krova/apis/krova-cloud-api.md) · [All operations](https://skmtc.dev/krova/apis/krova-cloud-api/llms.txt) · [OpenAPI document](https://skmtc.dev/krova/apis/krova-cloud-api/revisions/46bb68281ce1?raw)