---
title: "Approve a device authorization"
method: POST
path: "/v1/auth/device/approve"
tags: ["Account"]
---

# Approve a device authorization

`POST /v1/auth/device/approve`

## Request

- Base URL: `https://api.spacefast.com`
- URL: `https://api.spacefast.com/v1/auth/device/approve`
- Auth: API key in cookie `__Host-better-auth.session_token`

Approves a pending device login with an enforced team scope and an explicit scope checklist. If an explicit claim handoff is attached, the anonymous space is claimed into the chosen destination team after approval wins. The CLI receives a one-time API key on its next poll.

## Request body

- object
  - `userCode` string, required: User code shown on the device being approved (dashes ignored).
  - `teams` union, required: Team access granted to the device: all current and future memberships, an explicit non-empty team list, or sign-in-only access.
    - object
      - `mode` 'all', required
    - object
      - `mode` 'teams', required
      - `teamIds` string[], required
    - object
      - `mode` 'none', required
  - `claimTeamId` string: Explicit destination team for a claim handoff. Required when the flow carries a claim.
  - `scopes` string[], required: OAuth scopes the approver granted — a subset of the scopes the device requested. Authority is these scopes' actions, bounded per team by the holder's live role on every request.
  - `agentContinuation` boolean: Applies when the device flow carries an anonymous-space claim. Keeps the publishing agent authorized after the claim through the one-time claim-token exchange. Defaults to false.

## Response `200`

Response for status 200

- object
  - `$schema` string, uri: Canonical JSON Schema URL for this response body. The server also sends it in the `Link: rel="describedby"` response header.
  - `data` object, required
    - `status` 'approved', required: The device authorization is approved.
    - `claimedSpaceId` string, nullable, required: Space claimed by the server-side claim handoff, if one was attached.

## Other responses

- `default`: Problem details (RFC 9457). Any 4xx/5xx response is one `application/problem+json` document.

---

[API](https://skmtc.dev/spacefast/apis/spacefast-api.md) · [All operations](https://skmtc.dev/spacefast/apis/spacefast-api/llms.txt) · [OpenAPI document](https://skmtc.dev/spacefast/apis/spacefast-api/revisions/bd165bc7c983?raw)