oauth

Device Token

Current oauth HTTP operation. No resource-scope middleware on this operation. Access is resolved for the authenticated user or by the endpoint-specific OAuth checks. Production rate limit: 240 requests per 15-minute window, per client IP. RateLimit headers report the current window; respect Retry-After on 429. Poll with the returned device_code and original client_id. Pending authorization returns an OAuth 400 body. Malformed request bodies return the standard validation 400 envelope. Invalid, consumed, expired, mismatched-client, or disallowed-permission device codes return the standard 401 envelope.

post/oauth/device/token

Request

  • Base URL: https://api.ranch.bot
  • URL: https://api.ranch.bot/oauth/device/token
  • Auth: none required

Request body

grant_type'urn:ietf:params:oauth:grant-type:device_code' required
device_codestring required
client_idstring required

Response

Success

scopestring required
access_tokenstring required
token_type'Bearer' required
expires_innumber required
refresh_tokenstring

Returned for normal registered clients. The observer client (ranchbot-pi-observer-v1) omits this field; observer sessions cannot be refreshed.

Changes

No recorded changes to this operation across all 1 revision of this API.