---
title: "On Device Auth"
method: POST
path: "/on-device/auth"
---

# On Device Auth

`POST /on-device/auth`

## Request

- Base URL: `https://api.neuphonic.com` (the document declares no server; this is the origin it was published from)
- URL: `https://api.neuphonic.com/on-device/auth`
- Auth: none declared

Gates NeuphonicSDK on-device usage. Called by the SDK's outer gate
(`__validate_customer_token`) on every `initialize(apiToken:)`.

Two checks, both required:
1. The caller's on-device API key is valid (`on_device_api_keys`, a
   table separate from streaming `api_keys`).
2. The customer + device pair is allowed and logged server-side
   against `the_stage` Supabase (`log_device_auth`) — never called
   from the device directly, since that would require shipping a
   Supabase service key inside the app.

When the SDK sends a `nonce`, the response is signed (see
`on_device_signing`) and the SDK arms the engine only if the signature
verifies, so a faked 200 from anywhere else is useless. Without a nonce
the response stays unsigned, for SDK builds that predate signing.

## Headers

- `X-API-KEY` string, nullable

## Request body

- OnDeviceAuthBody
  - `deviceId` string, required
  - `nonce` string, nullable

## Response `200`

Successful Response

- unknown

## Other responses

- `422`: Validation Error

## Changes

- **2026-10-16** `7e9f5a90de2b`: 1 info
  - endpoint added

[Operation history](https://skmtc.dev/neuphonic/apis/neuphonic-api/changes/on-device/auth/post.md)

---

[API](https://skmtc.dev/neuphonic/apis/neuphonic-api.md) - [All operations](https://skmtc.dev/neuphonic/apis/neuphonic-api/llms.txt) - [OpenAPI document](https://skmtc.dev/neuphonic/apis/neuphonic-api/revisions/941fd29844c9?raw)