---
title: "Exchange an approved device code for an API key (device authorisation flow)."
method: POST
path: "/device/credential"
tags: ["Discovery"]
---

# Exchange an approved device code for an API key (device authorisation flow).

`POST /device/credential`

## Request

- Base URL: `https://docs.sleeperhit.studio/api/v1`
- URL: `https://docs.sleeperhit.studio/api/v1/device/credential`
- Auth: HTTP bearer

Poll this after starting a device authorisation. ⚠️ THIS ENDPOINT DOES NOT USE THE API's STANDARD ERROR ENVELOPE. It follows RFC 8628 instead, returning `{ error, error_description }` with `authorization_pending` while the user has not yet approved, then `invalid_grant`, `expired_token`, `access_denied`, or `invalid_request`. Every other v1 route returns the common error object.

## Request body

- object
  - `device_code` string, required

## Response `200`

A newly issued API key. The secret is returned ONCE.

- object
  - `access_token` string: Shown once and never retrievable again.
  - `token_type` string
  - `key_prefix` string
  - `scopes` string[]
  - `expires_at` string, date-time, nullable: When the key stops working: 90 days after the sign-in. Signing in again mints a new key with a fresh lifetime.

## Other responses

- `400`: RFC 8628 polling error — NOT the common error envelope.

---

[API](https://skmtc.dev/sleeperhit/apis/sleeper-hit-studio-story-api.md) · [All operations](https://skmtc.dev/sleeperhit/apis/sleeper-hit-studio-story-api/llms.txt) · [OpenAPI document](https://skmtc.dev/sleeperhit/apis/sleeper-hit-studio-story-api/revisions/86e084144cef?raw)