---
title: "Poll an agent-started connection. After browser approval, collects the repository credential and the chosen workspace/Product binding."
method: POST
path: "/api/v1/onboarding/repo/connect/token"
tags: ["onboarding"]
---

# Poll an agent-started connection. After browser approval, collects the repository credential and the chosen workspace/Product binding.

`POST /api/v1/onboarding/repo/connect/token`

Request states (AUTHORIZATION_PENDING, SLOW_DOWN, EXPIRED, ACCESS_DENIED, FORBIDDEN, PRODUCT_REQUIRED, KEY_CHOICE_CHANGED, ALREADY_REDEEMED, INVALID_REQUEST) come back as a machine-readable code with an error message and interval. The terminal ones close the request, so the next attempt starts a new one. Approval never creates a key; the key is created or reused, and any approved replacement is revoked, in one transaction when the agent collects. After collection, the device secret alone can never retrieve a credential again: resuming needs the exact bound key, as Bearer or as redemptionKey. Responses set Cache-Control: no-store.

## Request body

- object
  - `deviceSecret` string, required — The pm_pair_ secret returned by connect/start.
  - `redemptionKey` string — A pm_live_ key the client generated for this request (64 hex characters after the prefix). When a new key is needed, the server stores only its hash. Sending the same value again resumes a collection whose response was lost.
  - `sessionId` string — The session returned by an earlier collection. With the exact bound key as Bearer, it resumes after the request itself has been cleaned up.

## Response `200`

Approved and collected; returns the binding and either the new apiKey or reusedCredential:true.

- object

## Other responses

- `202` — AUTHORIZATION_PENDING: not approved yet. Poll again after interval seconds.
- `400` — The device secret, redemptionKey, or sessionId is malformed.
- `401` — A key supplied to resume a collected request is invalid or expired.
- `403` — ACCESS_DENIED (denied or discarded in the browser) or FORBIDDEN (the approver's workspace access changed).
- `409` — ALREADY_REDEEMED, INVALID_REQUEST, PRODUCT_REQUIRED, or KEY_CHOICE_CHANGED (the approved key choice no longer holds; start a new request).
- `410` — EXPIRED: the request expired before it was collected. Start a new one.
- `429` — SLOW_DOWN: polled faster than the interval or over the rate limit. Add 5 seconds to the interval.
- `503` — The request or its session could not be checked.

## Changes

- **2026-09-27** `0f4a7b92b504` — 1 info
  - endpoint added

[Change history](https://skmtc.dev/pathmode/apis/pathmode-api/changes/api/v1/onboarding/repo/connect/token/post.md)

---

[API](https://skmtc.dev/pathmode/apis/pathmode-api.md) · [All operations](https://skmtc.dev/pathmode/apis/pathmode-api/llms.txt) · [OpenAPI document](https://skmtc.dev/pathmode/apis/pathmode-api/revisions/0f4a7b92b504?raw)