Approve a pending client authorization

Approves a pending authorization created by POST /v2/account/authorize/start (browser flow, identified by code) or POST /v2/account/authorize/device (CLI flow, identified by the user_code the person typed).

Approval only fills a slot the client created and that nobody approved yet — it can never create one. That is what stops an attacker from overwriting someone else's pending authorization with their own account.

display is required: the person must type (or confirm) the 8-character code their editor/CLI is showing. Knowing the code alone is not enough to approve, which is what makes a forged consent link fail.

Nothing is issued here. The scopes stored at start are the ones granted (they are never re-read from the request), and the key itself is only minted when the client redeems the grant at POST /v2/account/authorize/claim — so the secret never sits in Redis waiting to be collected. After approval the grant lives for 60 seconds.

Before approving, the page must show the client name, the scopes, and the confirmation code.

Session token only.