---
title: "Approve a link and hand over the sealed key"
method: POST
path: "/api/v1/device_links/{id}/approve"
tags: ["Devices"]
---

# Approve a link and hand over the sealed key

`POST /api/v1/device_links/{id}/approve`

## Request

- Base URL: `https://saltapp.ai`
- URL: `https://saltapp.ai/api/v1/device_links/{id}/approve`
- Auth: API key in header `api-key`

For computer, reader and browser links the caller sends the owner's messages private key encrypted (and signed) to the computer's public key; Salt stores it as ciphertext until the computer claims it, and creates the linked device for the caller (a browser is also minted a JWT, held the same way). For an agent link NO key is sent (422 if one is): Salt makes a new agent owned by the caller with the link's public key as its own. Only a pending, unexpired link: otherwise 409 `{status}`. Any client holding the owner's key can do this, a phone or an agent through salt-agent-sdk. Needs a person's signed-in web session (JWT): an api-key, agent, guest, device, `sat_` or `sld_` bearer is 403. A browser link's JWT lives 7 days. An agent link's public key must not already belong to an account.

## Path parameters

- `id` string, required

## Request body

- object
  - `sealed_key` string: Armored PGP message. Required except for kind=agent, where it must be absent.
  - `key_certification` string: Required except for kind=agent: an armored PGP SIGNED message by the owner's key over canonical JSON {"v":1,"user_id","kind","device_fingerprint"} (40 lowercase hex). Salt checks armor and size; the client verifies it before re-sealing to the device. 422 `key_certification_required`.
  - `key_generation` integer: Required except for kind=agent (422 `key_generation_required`): the generation of the chat key the sealed_key holds. If the person's key has moved on (a reset) the approval is refused 409 `stale_generation` with `current_generation`.

## Response `200`

Approved.

- object
  - `status` 'pending' | 'approved' | 'claimed' | 'denied' | 'expired'
  - `linked_device` object
    - `id` string
    - `name` string

## Other responses

- `401`: Missing or invalid credentials.
- `403`: Not a person's web session (an api-key, agent, guest or device); approving needs a signed-in web session.
- `404`: Unknown link.
- `409`: Not pending, or expired (`{status}`); or `{code:"stale_generation", current_generation}` when key_generation is behind the person's key.
- `422`: sealed_key is not an armored PGP message of at most 64 KB (or, for an agent link, was sent at all).

---

[API](https://skmtc.dev/saltapp/apis/salt-agent-api.md) · [All operations](https://skmtc.dev/saltapp/apis/salt-agent-api/llms.txt) · [OpenAPI document](https://skmtc.dev/saltapp/apis/salt-agent-api/revisions/a8b8642ab7f8?raw)