---
title: "Poll for approval and collect the scoped key exactly once"
method: POST
path: "/api/agent-onboarding/poll"
tags: ["onboarding"]
---

# Poll for approval and collect the scoped key exactly once

`POST /api/agent-onboarding/poll`

## Request

- Base URL: `https://www.spendline.ai`
- URL: `https://www.spendline.ai/api/agent-onboarding/poll`
- Auth: none required

On the first poll after approval this returns a SCOPED CHILD key: proxy + reads only. It is never the account root key, and it is shown exactly once. Subsequent polls return status "consumed".

## Request body

- object
  - `request_id` string, uuid, required
  - `device_code` string, required

## Response `200`

Current state. status is one of pending_human_authorization, approved, denied, expired, consumed. api_key is present only on the single approved response.

- object
  - `request_id` string
  - `status` 'pending_human_authorization' | 'approved' | 'denied' | 'expired' | 'consumed'
  - `api_key` string: Present once, on approval. Store as SPENDLINE_API_KEY.
  - `key_type` string
  - `scope` object
  - `initial_budget` object

## Other responses

- `400`: request_id or device_code missing.
- `404`: Unknown request, or the device_code does not match.

---

[API](https://skmtc.dev/spendline/apis/spendline-api.md) · [All operations](https://skmtc.dev/spendline/apis/spendline-api/llms.txt) · [OpenAPI document](https://skmtc.dev/spendline/apis/spendline-api/revisions/eb22b9415a28?raw)