---
title: "Approve a CLI loopback-PKCE login (passkey + step-up)"
method: POST
path: "/agent/v1/control-plane/cli/approve"
tags: ["ControlPlane"]
---

# Approve a CLI loopback-PKCE login (passkey + step-up)

`POST /agent/v1/control-plane/cli/approve`

## Request

- Base URL: `https://api.run402.com`
- URL: `https://api.run402.com/agent/v1/control-plane/cli/approve`
- Auth: HTTP bearer

Mints a single-use auth code bound to the approving principal + amr; returns the loopback redirect URL the browser navigates to. Requires a passkey-fresh session (step-up op_class cli.authorize).

## Request body

- object
  - `flow_id` string, uuid, required

## Response `200`

Approved; redirect_url to the loopback server

- object

## Other responses

- `403`: Step-up required (STEP_UP_REQUIRED)
- `409`: Flow not pending (FLOW_NOT_PENDING)

---

[API](https://skmtc.dev/run402/apis/run402-api.md) · [All operations](https://skmtc.dev/run402/apis/run402-api/llms.txt) · [OpenAPI document](https://skmtc.dev/run402/apis/run402-api/revisions/893607557f50?raw)