---
title: "Start the device-code flow."
method: POST
path: "/oauth/device_authorization"
tags: ["OAuth"]
---

# Start the device-code flow.

`POST /oauth/device_authorization`

## Request

- Base URL: `https://api.ownerrez.com`
- URL: `https://api.ownerrez.com/oauth/device_authorization`
- Auth: HTTP basic

Send `application/x-www-form-urlencoded`. Show the returned `user_code` and `verification_uri` to the user, then poll `POST /oauth/token` with `grant_type=urn:ietf:params:oauth:grant-type:device_code` no faster than `interval` seconds. Polling answers `authorization_pending` until the user consents, `slow_down` if you poll too fast, and `expired_token` once the code lapses.

Authenticates the OAuth app itself, not a user: HTTP Basic with your client id as the username and client secret as the password. An account email and Personal Access Token do not work here.

## Request body `application/x-www-form-urlencoded`

- object
  - `scope` string: Requested scope: read or full.
  - `client_id` string: Optional. When present, must match the Basic-authenticated client.

## Response `200`

The device and user codes.

- object
  - `device_code` string: The code to poll the token endpoint with.
  - `user_code` string: The code the user types, formatted XXXX-XXXX.
  - `verification_uri` string: Where the user enters the code.
  - `verification_uri_complete` string: The same page with the code prefilled.
  - `expires_in` integer: Seconds until the device code expires.
  - `expires_on` string: Expiry timestamp of the device code, ISO 8601 UTC.
  - `interval` integer: Minimum seconds between polls.

## Other responses

- `400`: The request was rejected. Note the OAuth 2.0 error shape, which differs from the rest of the API.
- `401`: App authentication failed. Body is `{Message}` (ASP.NET HttpError), not the OAuth `{error, error_description}` shape. Missing Basic also sends `WWW-Authenticate: Basic realm=ownerrez_oauthapp`.

## Changes

- **2026-10-01** `838877899156`: 1 info
  - endpoint added

[Operation history](https://skmtc.dev/ownerrez/apis/ownerrez-api/changes/oauth/device_authorization/post.md)

---

[API](https://skmtc.dev/ownerrez/apis/ownerrez-api.md) - [All operations](https://skmtc.dev/ownerrez/apis/ownerrez-api/llms.txt) - [OpenAPI document](https://skmtc.dev/ownerrez/apis/ownerrez-api/revisions/c400448b7a2a?raw)