---
title: "Device verification page (RFC 8628 user-facing approval)"
method: GET
path: "/oauth/device"
tags: ["OAuth"]
---

# Device verification page (RFC 8628 user-facing approval)

`GET /oauth/device`

## Request

- Base URL: `https://api.mnemom.ai/v1`
- URL: `https://api.mnemom.ai/v1/oauth/device`
- Auth: none required

Server-rendered approval page a human opens (from verification_uri / verification_uri_complete) to authorize a device. Unauthenticated users are redirected to the hosted login and returned here. Leads with the user_code so the human confirms it matches their device before an explicit Approve (RFC 8628 §5.4). Same origin as the AS so the session cookie + CSRF apply.

## Query parameters

- `user_code` string

## Response `200`

The approval page (HTML), or a terminal result page (invalid/expired code).

## Other responses

- `302`: Redirect to the hosted login (unauthenticated), returning here after sign-in.
- `400`: Missing or malformed user_code (HTML).
- `404`: No live device code for that user_code (HTML).
- `429`: Rate-limit exceeded. The global per-IP limiter (100 requests/minute, applied to every `/v1/*` route) rejected this request. Back off until the window resets — `Retry-After` carries the cooldown in seconds and `X-RateLimit-Reset` the absolute reset time.
- `500`: Server error — request was well-formed but the server failed to fulfill it. Typically a downstream dependency (DB / RPC / external API) returned an unexpected error.

---

[API](https://skmtc.dev/mnemom/apis/mnemom-api.md) · [All operations](https://skmtc.dev/mnemom/apis/mnemom-api/llms.txt) · [OpenAPI document](https://skmtc.dev/mnemom/apis/mnemom-api/revisions/274b7a6ea182?raw)