---
title: "Start a device login"
method: POST
path: "/oauth/device/code"
tags: ["Authentication"]
---

# Start a device login

`POST /oauth/device/code`

## Request

- Base URL: `https://api.app.layer.ai/api`
- URL: `https://api.app.layer.ai/api/oauth/device/code`
- Auth: none required

OAuth 2.0 device authorization (RFC 8628 section 3.1), for Layer's own native clients: the plugin panels, the add-ons and the command-line interface. Show the person `user_code` and open `verification_uri_complete` in their browser, where they confirm the code and sign in; meanwhile poll the token endpoint with `grant_type=urn:ietf:params:oauth:grant-type:device_code` every `interval` seconds. The optional device fields describe the device on the confirm screen and on the person's Devices page.

## Response `200`

Successful Response

- IssuedDeviceCode: The device authorization response (RFC 8628 section 3.2).
  - `device_code` string, required
  - `user_code` string, required
  - `verification_uri` string, required
  - `verification_uri_complete` string, required
  - `expires_in` integer, required
  - `interval` integer, required

## Other responses

- `400`: An OAuth 2.0 error
- `401`: Unknown client
- `422`: Validation Error
- `429`: Too many device logins started from this address

## Changes

- **2026-10-20** `338ab50d11cd`: 5 info
  - added the new optional request property `app`
  - added the new optional request property `app_version`
  - added the new optional request property `client_version`
  - added the new optional request property `device_name`
  - …1 more
- **2026-10-19** `0581965f4bc0`: 1 info
  - endpoint added

[Operation history](https://skmtc.dev/layer/apis/layer-rest-api/changes/oauth/device/code/post.md)

---

[API](https://skmtc.dev/layer/apis/layer-rest-api.md) · [All operations](https://skmtc.dev/layer/apis/layer-rest-api/llms.txt) · [OpenAPI document](https://skmtc.dev/layer/apis/layer-rest-api/revisions/326f3bcdabcc?raw)